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Preface 


Preface 


The SIMATIC automation system unites all the subsystems of an automation solu- 
tion under a uniform system architecture to form a homogenous whole from the 
field level right up to process control. 


The Totally Integrated Automation (TIA) concept permits uniform handling of all 
automation components using a single system platform and tools with uniform 
operator interfaces. These requirements are fulfilled by the SIMATIC automation 
system, which provides uniformity for configuration, programming, data manage- 
ment, and communication. 


This book describes the hardware components of the SIMATIC S7-400 automation 
system with standard controllers, and the features provided for designing a distrib- 
uted control concept with PROFIBUS and PROFINET. To permit communication with 
other automation systems, the controllers offer integrated bus interfaces for multi- 
point interface (MPI), PROFIBUS, and Industrial Ethernet. 


The STEP 7 Professional engineering software makes it possible to use the complete 
functionality of the S7-400 controllers. STEP 7 Professional is the common tool for 
hardware configuration, generation of the user program, and for program testing 
and diagnostics. 


STEP 7 Professional provides five languages for generation of the user program: 
Ladder logic (LAD) with a graphic representation similar to a circuit diagram, func- 
tion block diagram (FBD) with a graphic representation based on electronic circuit- 
ry systems, statement list (STL) with formulation of the control task as a list of com- 
mands at machine level, a high-level Structured Control Language (SCL) similar to 
Pascal, and finally GRAPH as a sequencer with sequential processing of the user 
program. 


STEP 7 Professional supports testing of the user program by means of watch tables 
for monitoring, control and forcing of tag values, by representation of the program 
with the current tag values during ongoing operation, and by offline simulation of 
the programmable controller. 


This book describes the configuration, programming, and testing of the S7-400 
automation system with the STEP 7 Professional engineering software Version 11 
with Service Pack 4. 


Erlangen, June 2013 Hans Berger 
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The contents of the book at a glance 


Start 


Overview of the SIMATIC S7-400 automation system. 
Introduction to the SIMATIC STEP 7 Professional V11 engineering software. 


The basis of the automation solution: Creating and editing a project. 


SIMATIC 87-400 automation system 


Overview of SIMATIC S7-400 modules: Design of an automation system, CPUs, signal, func- 
tion and communication modules. 


Device configuration 


Configuration of a station, parameterization of modules, and networking of stations. 


Tags, addressing, and data types 


The properties of inputs, outputs, I/O, bit memories, data, and temporary local data as oper- 
and areas, and how they are addressed: absolute, symbolic, and indirect. 


Description of elementary and compound data types, data types for block parameters, point- 
ers, and user data types. 


Program execution 


How the CPU module responds in the STARTUP, RUN, and STOP modes. 


How the user program is structured with blocks, what the properties of these blocks are, 
and how they are called. 


How the user program is executed: startup characteristics, main program, interrupt process- 
ing, troubleshooting, and diagnostics. 


The program editor 


Working with the PLC tag table, creating and editing code and data blocks, compiling blocks, 
and evaluating program information. 


The ladder logic programming language LAD 


The characteristics of LAD programming; series and parallel connection of contacts, the use 
of coils, standard boxes, Q boxes, and EN/ENO boxes. 


The function block diagram programming language FBD 


The characteristics of FBD programming; boxes for binary logic operations, the use of stan- 
dard boxes, Q boxes, and EN/ENO boxes. 


The statement list programming language STL 


The characteristics of STL programming; programming of binary logic operations, applica- 
tion of digital functions, and control of program execution. 
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The structured control language SCL 


The characteristics of SCL programming; operators and expressions, working with binary 
and digital functions, control of program execution using control statements. 


The S7-GRAPH sequential controller 


What a sequential control is, and what its elements are: sequencers, steps, transitions, and 
branches. How a sequential control is configured using $7-GRAPH. 


Description of the control functions 


Basic functions: Functions for binary signals: binary logic operations, memory functions, 
edge evaluations, SIMATIC and IEC timer and counter functions. 


Digital functions: Functions for digital tags: transfer, comparison, arithmetic, math, conver- 
sion, shift, and logic functions. 


Program flow control: Working with status bits, programming jump functions, calling and 
closing blocks, using the master control relay. 


Online operation and program testing 


Connecting a programming device to the PLC station, switching on online mode, transfer- 
ring the project data, and protecting the user program. 


Loading, modifying, deleting, and comparing the user blocks. 


Working with the hardware diagnostics and testing the user program. 


Distributed I/O 


Overview: The ET 200 distributed I/O system. 
How a PROFINET IO system is configured, and what properties it has. 
How a PROFIBUS DP master system is configured, and what properties it has. 


Communication 


The properties of S7 basic communication and of S7 communication, and with what commu- 
nication functions they are programmed. 


The communication functions used to implement open user communication. 


How PtP communication is implemented. 


Annex 


How external source files are created and imported for STL and SCL blocks. 

How a project created using STEP 7 V5.x is migrated to the TIA Portal. 

How the user program is tested offline using the S7-PLCSIM simulation software. 
How the Web server is configured in the CPU, and what features it offers. 


How block parameters and local tags are saved in the memory. 
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1.1 Overview of the S7-400 automation system 


1 Introduction 


1.1 Overview of the S7-400 automation system 


SIMATIC S7-400 is the modular control system for the medium and upper perfor- 
mance range (Fig. 1.1). Different versions of the controllers allow the performance 
to be matched to the respective application. Depending on the requirements, the 
programmable controller can be modularly expanded by input/output modules for 
digital and analog signals in up to 21 racks with up to 18 modules. 


Further expansion with input/output modules is made possible by the distributed 
I/O over PROFIBUS or PROFINET. Special designs of these modules for increased 
mechanical demands allow their installation directly on site on the machine or 
plant. STEP 7 is used to configure and program the SIMATIC S7-400controllers. Data 


SIMATIC S7-400 automation system 


SIMATIC S7-400 


SIMATIC controllers control Several versions of the controllers 
the machine or plant. expand the range of use. 


aol ik 


SIMATIC NET Networking allows data exchange 
and central online access. 


aT 
i 


| SIMATIC DP STEP 7 

iz | Professional 
ee STEP 7 is the engineering software for 

The distributed I/O expands the configuration and programming. 

interface to the machine or plant. 


Fig. 1.1 Components of the SIMATIC S7-400 automation system 
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exchange between the controllers, the distributed I/O, and the programming device 
is carried out over SIMATIC NET. 


1.1.1 SIMATIC S7-400 programmable controller 


The most important components of an S7-400 programmable controller are shown 
in Fig. 1.2. 


The CPU contains the operating system and the user program. The user program is 
in the load memory of the CPU, which can be expanded with a SIMATIC Memory 
Card (MC). The user program is executed in the CPU's work memory. The bus inter- 
faces present on the CPU establish the connection to other programmable control- 
lers. 


Components of an S7-400 controller 


Rack -——<___ = rack 


PS module 
(power supply) 


CPU module 
(central processing unit) 


On the racks are 
pluggable: 


SM modules 


(signal modules) IM module 
(interface module) 


FM modules : 
(function modules) Expansion rack 


CP modules 
(communications 
processors) 


The racka are available 
in various widths: 
18, 9, and 4 slots. 


Fig. 1.2 Components of an $7-400 controller 
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Signal modules (SM) are responsible for the connection to the controlled plant. 
These input and output modules are available for digital and analog signals. 


The function modules (FM) are signal-preprocessing, “intelligent” I/O modules 
which prepare signals coming from the process independent of the CPU and either 
return them directly to the process or make them available at the CPU's internal 
interface. Function modules are responsible for handling functions which the CPU 
cannot usually execute quickly enough, such as counting pulses, positioning, or 
controlling drives. 


The CP modules allow data transfer in excess of the possibilities provided by the 
standard interfaces on the CPU with regard to protocols and communication func- 
tions. 


In the case of an expansion, the interface modules (IM) connect the central rack 
to a maximum of 21 expansion racks. 


Finally, a power supply module provides the internal voltages required by the pro- 
grammable controller. Load voltages or load currents must be provided via external 
load current supply units. 


1.1.2. Overview of STEP 7 Professional V11 


STEP 7 is the central automation tool for SIMATIC. STEP 7 requires authorization (li- 
censing) and is executed on the current Microsoft Windows operating systems. 
Configuration of an S7-400 controller is carried out in two views: the Portal view 
and the Project view. 


The Portal view is task-oriented. 


In the Start portal you can open an existing project, create a new project, or migrate 
a project. A “project” is a data structure containing all the programs and data 
required for your automation task. The most important STEP 7 tools and functions 
can be accessed from here via further portals (Fig. 1.3): 


In the Devices & networks portal you configure the programmable controllers, 
i.e. you position the modules in a rack and set their parameters. 


In the PLC programming portal you create the user program in the form of indi- 
vidual sections referred to as “blocks”. 


The Visualization portal provides the most important tools for configuration and 
simulation of HMI systems using SIMATIC WinCC. 


The Online & Diagnostics portal allows you to connect the programming device 
online to a CPU. You can control the CPU's operating modes and transfer and test 
the user program. 


The Project view is an object-oriented view with several windows whose contents 
change depending on the current activity. In the Device configuration, the focal 
point is the working area with the device to be configured. The Device view includes 
the rack and the modules which have already been positioned (Fig. 1.4). A further 
window - the inspector window - displays the properties of the selected module, 
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@ Open existing project 


e@ Create new project 


@ Migrate project 


Close project 
pro} 


@ Welcome Tour 


@ First steps 


Fig. 1.3 Tools in the Start portal of STEP 7 Professional V11 
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Fig. 1.4 Example of a Project view: working area of the device configuration 
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and the task window provides support by means of the hardware catalog with the 
available modules. The Network view allows networking between PLC and HMI sta- 
tions. 


When carrying out PLC programming, you edit the selected block in the working 
area. You are again shown the properties of the selected object in the inspector win- 
dow where you can adjust them. In this case, the task window contains the program 
elements catalog with the available program elements and statements. The same 
applies to the processing of PLC tags or to online program testing using watch 
tables. 


And you always have a view of the project navigation. This contains all objects of the 
STEP 7 project. You can therefore select an object at any time, for example a pro- 
gram block or watch table, and edit this object using the corresponding editors 
which start automatically when the object is opened. 


1.1.3 Five programming languages 


You can select between five programming languages for the user program: ladder 
logic (LAD), function block diagram (FBD), statement list (STL), structured control 
language (SCL), and sequential control (GRAPH). 


Using the ladder logic, you program the control task based on the circuit diagram. 
Operations on binary signal states are represented by serial or parallel arrange- 
ment of contacts and coils (Fig. 1.5). Complex functions such as arithmetic func- 
tions are represented by boxes which you arrange like contacts or coils in the ladder 
diagram. 


Using the function block diagram, you program the control task based on electronic 
circuitry systems. Binary operations are implemented by linking AND and OR func- 
tions and terminated by memory boxes (Fig. 1.6). Complex boxes are used to handle 
the operations on digital tags, for example with arithmetic functions. 


Using the statement list, you program the control task using a sequence of state- 
ments. Every STL statement contains the specification of what has to be done, and 
possibly an operand with which the operation is executed. STL is equally suitable 


#Fant.works #Fan1.works #Display.onefan 
#Fan2.works #Fan2.works 


“Clock 2 HZ #Display.nofan 


 ———<——S |e 


Fig. 1.5 Example of representation in ladder logic 
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#Alarm_bit #Alarm_memory 
P SR 
—s 
#Alarm_bit_ 


edge_memory 


#Acknowledge — RT Qo— #Alarm_lamp 


“Clock 0,5 HZ — 3 —_—_ _ 


Fig. 1.6 Example of representation in function block diagram 


for binary and digital operations and for programming complex open-loop control 
tasks (Fig. 1.7). 


1 //Motor memory 

2 A "Switch-on_manual” 

3 A "Manual_mode" 

4 ie) 

5 A “Switch-on_automatic”™ 

6 AN “Manual_mode” 

7 § #Motor_memory //Set memory 
8 

9 “Switch-off manual” 

10 °O “Switch-off_automatic” 

11 ON “Motor fault” 

12 R #Motor_memory //Reset memory 
13 


Fig. 1.7 Example of STL statements 


Structured control language is particularly suitable for programming complex al- 
gorithms or for tasks in the area of data management. The program is made up of 
SCL statements which, for example, can be value assignments, comparisons, or 
control statements (Fig. 1.8). 


Pr 
‘o 


Write_register: / fH HH HHH HH HEHEHE H FEHR HHH HHH RHEE HRRKHE 
IF #Level = #Register_length - 1 
THEN #Full := TRUE; 
ELSE #Register[#Write_pointer] := #Input_value; 
#Level := #Level + 1; 
IF #Write_pointer = #Register_length 
THEN #Write_pointer := 0; 
ELSE #Write_pointer : 
END_IF; 
#Empty := FALSE; 
LEND_IF; RETURN; 


o 
T 


NB 


wo 


A 
T 


uw 


oO 


#Write_pointer + 1; 


os) 


NNNN NHN DN DY 
co 


wo 


Fig. 1.8 Example of SCL statements 
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| v7 ach Interlock Event Qualifier Action 
53 +c} $1 s -Setto1 "Milling drive" 
- $1 s -Setto1 "Tension_valve” 
Shafting $1 S  -Setto1 "Blower_motor" 
B <Add new> 
Down 
$4 
Lifting 
T4 T6 
Complete Next 
$5 s6 
Drives_off Position_new 
tS 77 
Switched Reached 
$3 


Fig. 1.9 Example of a GRAPH sequencer and step configuration 


Using GRAPH, you program a control task as a sequence control in which a se- 
quence of actions prevails. The individual steps and branches are enabled by step 
enabling conditions which can be programmed using LAD or FBD (Fig. 1.9). 


1.1.4 Execution of the user program 


After the power supply has been switched on, the control processor checks the con- 
sistency of the hardware and parameterizes the modules. A startup program is then 
executed once, if present. The startup program belongs to the user program which 
you produce. Modules can be initialized, for example, by the startup program. 


The user program is usually divided into individual sections called “blocks”. The or- 
ganization blocks (OB) represent the interface between operating system and user 
program. The operating system calls an organization block for specific events, and 
the user program is then processed in it (Fig. 1.10). 


Function blocks (FB) and functions (FC) are available for structuring the program. 
Function blocks have a memory in which local tags are saved permanently; func- 
tions do not have this memory. 


Program statements are available for calling function blocks and functions (start of 
execution). Each block call can be assigned inputs and outputs, referred to as “block 
parameters”. During calling, tags can be transferred with which the program in the 
block is to work. In this manner, a block can be repeatedly called with a certain func- 
tion (e.g. addition of three tags), but with different parameters sets (e.g. for differ- 
ent calculations) (Fig. 1.11). 
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Execution of the user program 


Operating system User program 


er Operating mode 
Switching on | —*F 6B] 4 FB FB Startup STARTUP 
re Fe 


program 


Updating of inputs | Operating mode 
and outputs > OB FB FB. Main RUN 9 
AC FC program 


\ \ Alarm and error 


program 


: OB FB FB 
Interruption : a A EC FC 
(alar or error) Sr cc eniiietonitettaieiateatatateletetatetatatatetel Interruption ~ 


Fig. 1.10 Execution of the user program 


The data of the user program is saved in data blocks (DB). Instance data blocks have 
a fixed assignment to a call of a function block and are the tag memory of the func- 
tion block. Global data blocks contain data which is not assigned to any block. 


Following a restart, the control processor updates the input and output signals in 
the process images and calls the organization block OB 1. The main program is 
present here. Structuring is also possible and recommended in the main program. 
Once the main program has been processed, the control processor returns to the 
operating system, retains (for example) communication with the programming de- 
vice, updates the input and output signals, and then recommences with execution 
of the main program. 


Network 1: Program of adder Network 5: First call ofadder 
ADD “Adder.FBD" 
Int EN 
~— EN “Data.FBD". 
#Number_1 — IN1 OUT — #Sum Measurement[1] — Number_1 


#Number_2 — IN2 ENO — "Data FBD". 


Measurement[2] — Number 2 “Data.FBD". 


ADD “Data .FBD". Result — Result{1] 
Int Measurement(3] — Number_3 ENO — 
= EN 
#Sum — IN1 OUT — #Result 
#Number_3 — IN2 ENO — Network 6: Second call ofadder 
“Adder.FBD" 


= EN 
“Measuring 1* — Number_1 
“Measuring 2" — Number_2 Result — “Measuring sum* 
“Measuring 3° — Number_3 ENO — 


Fig. 1.11 Example of two block calls with different tags in each case 
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Cyclic program execution is a feature of programmable logic controllers. The user 
program is also executed if no actions are requested “from outside”, e.g. if the con- 
trolled machine is not running. This provides advantages when programming: For 
example, you program the ladder logic as if you were drawing a circuit diagram, or 
program the function block diagram as if you were connecting electronic compo- 
nents. Roughly speaking, a programmable controller has a characteristic like, for 
example, a contactor or relay control: the many programmed operations are effec- 
tive quasi simultaneously “in parallel”. 


In addition to the cyclically executed main program it is possible to carry out inter- 
rupt-controlled program execution. You must enable the corresponding interrupt 
event for this. This can be a hardware interrupt, such as a request from the con- 
trolled machine for a fast response, or a cyclic interrupt, in other words an event 
which takes place at defined intervals. 


The control processor interrupts execution of the main program when an event oc- 
curs, and calls the assigned interrupt program. Once the interrupt program has 
been executed, the control processor continues execution of the main program 
from the point of interruption. 


Data management in the SIMATIC S7-400 automation system 


Programming device 


Main memory Saving the project data Hard disk 
All project data is executed The offline project data is 
in the programming saved on the hard disk. 
device's main memory. 


Transfer with online connection or Memory Card 


CPU 400 
Load memory Memory Card MC 


The load memory contains the project data The memory card expands 
transferred to the CPU. Together with the current the load memory. RAM and FLASH 
values of the tags from the work memory, memory cards with different memory 
they form the online project data. sizes are available. 


Transfer when switching on 


Work memory Power supply 


A backup battery protects 
the program code and data in 
the load and work memory 
in the event of a power failure. 


The work memory contains the executable 
part of the control program which is 
processed during runtime. 


Fig. 1.12 Data management in the SIMATIC S7-400 automation system 
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1.1.5 Data management in the SIMATIC automation system 


The automation data is present in various memory locations in the automation 
system. First of all, there is the programming device. All automation data of a 
STEP 7 project is saved on its hard disk. Configuration and programming of the 
project data with STEP 7 are carried out in the main memory of the programming 
device (Fig. 1.12). 


The automation data on the hard disk is also referred to as the offline project data. 
Once STEP 7 has appropriately compiled the automation data, this can be down- 
loaded to a connected programmable controller. The data downloaded into the user 
memory of the CPU is known as the online project data. 


The user memory on the CPU is divided into two components: The load memory 
contains the complete user program, including the configuration data, and the 
work memory contains the executable user program with the current control data. 
The load memory can be expanded by means of a plug-in memory card (MC). Data 
retentivity - data values are not lost if there is a power failure — is achieved by using 
a backup battery. 


The project data can be transferred between the programming device and CPU us- 
ing a FLASH memory card. The normal case is an online connection for transfer, 
testing, and diagnostics. 


1.2 Introduction to STEP 7 Professional V11 


1.2.1 Installing STEP 7 


STEP 7 Professional V11 is executed on 
Windows XP Professional SP3, Win- 
dows 2003 Server R2 StdE SP2, Win- 
dows 7 (Professional, Enterprise, Ulti- 
mate) 32-bit and 64-bit, and Windows 
2008 Server StdE SP2 operating sys- 
tems. You require administration 
rights in order to install STEP 7, and to 
work with STEP 7 you must at least be 
logged-on as a main user. 


StHEMENS Totally integrated Automation 
PORTAL V11 


The processor should at least be a Pentium M with 1.6 GHz or a comparable type. 
The main memory should have a minimum size of 1 GB. STEP 7 Professional re- 
quires approximately 2 GB free memory on system drive C: on the hard disk. 


An interface module with an appropriate port is required on the programming de- 
vice for the online connection to the programmable controller. The connection can 
be established over MPI, PROFIBUS, or PROFINET (Ethernet). If you want to work 
with a programming device with amemory card, you need a corresponding EPROM 
programming module. 
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Installation is carried out using the setup program start.exe on the DVD. Uninstal- 
lation of STEP 7 Professional is carried out as usual in Windows using the Software 
program in the Windows Control Panel. 


1.2.2 Automation License Manager 


You require a license (user authorization) in order to use STEP 7. Licenses are man- 
aged by the Automation License Manager, which is installed together with STEP 7 
Professional. The license for STEP 7 Professional (license key) is provided on a USB 
flash drive. You will be requested to provide authorization during installation if a 
license key is not yet present on the hard disk. You can also carry out the authori- 
zation following installation of STEP 7. 


The license key is stored on the hard disk in specially identified blocks. To avoid un- 
intentional destruction of the license key, you should observe the information for 
handling license keys in the help text of the Automation License Manager. If you 
lose the license key, e.g. due to a defective hard disk, you can revert to the trial li- 
cense delivered with STEP 7, which is valid for a limited duration. 


The Automation License Manager also manages the license keys of other SIMATIC 
products such as STEP 7 V5.5 and WinCC. When uninstalling STEP 7 V11, ensure 
that the relevant license is also removed. If the license is still needed, you should 
back it up first.. 


1.2.3 Starting STEP 7 Professional 


You start STEP 7 Professional either using the Start button of Win- 

dows and Programs > Siemens Automation > TIA Portal V11, or by lA 
double-clicking on the icon on the Windows desktop. The Totally In- Be see wii 
tegrated Automation Portal (TIA Portal) is the framework in which 

STEP 7 is embedded. TIA Portal may also contain other applications 

that use the same database, such as WinCC Professional. 


1.2.4 Portal view 


Following initial starting-up, STEP 7 Professional displays the Start portal. A portal 
makes available all functions and tools required for the respective range of tasks in 
the portal view. The scope of the portals as well as the range of functions and tools 
depends on the installed applications. The Start portal of STEP 7 Professional per- 
mits selection of the following portals (Fig. 1.13): 


> Inthe Devices & networks portal, you can configure the hardware of the program- 
mable controller, i.e. you select the hardware components, position them, and 
set their properties. If several devices are networked, you can define the connec- 
tions here. 


> The PLC programming portal contains all the tools required for generating the 
user program for a PLC station. 
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> In the Visualization portal, you generate the operator control and monitoring in- 
terface for HMI stations. Here you can configure, for example, the process imag- 
es, the control elements, and messages. 


> Using the Online & Diagnostics portal, you can connect the programming device 
to a programmable controller, transfer and test programs, and search (and de- 
tect) faults in the automation system. 


Additional functions included in the Start portal are: Create new project, Open 
existing project, and Migrate project. The Welcome Tour and First steps provide an in- 
troduction to STEP 7. Installed software provides an overview of further SIMATIC ap- 
plications that are currently available on the programming device. You can call 
Help in every portal. The User interface language allows you to set the language for 
working with STEP 7. 


Firvt steps 


Project: "Project¥O0" was opened succesttuly, Phase select the next step: 


SS 


Contipne a device 


White PLC programm 
~ 


l Com igre an HAM vireen 


@ Fist eps 


Open the project view 


Fig. 1.13 Portal view: First steps after opening a project 
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1.2.5 Help information system 


HE Information System 


Es] [al 


During programming, the help 
function of STEP 7 provides you 
with comprehensive support for 


solving your automation task. nitorenation Syateen 


To call the help function, click on 
Help in the Portal view or select the 
Help > Show help command in the 
main menu in the Project view. A 
window appears with the help in- 
formation system (Fig. 1.14). 


The online help is roughly divided 
according to the project processing 
steps: Configuration, parameter- 
ization, and networking of devices, 
structuring and programming of 
the user program, visualization of 
processes, and utilization of the on- 
line and diagnostics functions. 


Readme provides general informa- 
tion on STEP 7 and further informa- 
tion which could no longer be in- 
cluded in the online help. 


A comprehensive description of all 
available statements, including ex- 
tended statements, can be found un- 
der Programming a PLC and Refer- 
ences. Fig. 1.14 Start page of the information system 


1.2.6 The windows of the Project view 


The Project view shows all elements of a project in structured form in various pro- 
cessing windows. You can move from the Portal view to the Project view using the 
Project view link at the bottom left of the screen, or STEP 7 automatically switches 
to the Project view depending on the selected tool. 


Fig. 1.15 shows the windows of the Project view in an example of block program- 
ming. Different window contents are displayed depending on the currently used 
editor. 


@ Main menu and toolbar, shortcut menu 


Underneath the title bar is the main menu with all menu commands. The menu 
commands available for selection depend on the currently marked object; menu 
commands which cannot be selected are displayed in gray. The same functionality 
is available - somewhat user-friendlier - with the shortcut menu: If you click on an 
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Fig. 1.15 Components of Project view using example of block programming 


object with the right mouse button, a window is opened with the currently select- 
able menu commands. Underneath the main menu is the toolbar with the graphi- 
cally represented “main functions”. The main menu and the toolbar are always 
present in all editors. 


Using Options > Settings in the main menu, you can adapt the user interface. For 
example, under “General” you can define the user interface language in which 
STEP 7 is used, and the mnemonics (the representation of the operands: “I” for 
input in English, or “E” in German). 


@ Working window 


In the center of the screen is the working window. The contents of the working win- 
dow depend on the editor currently being used. In the case of device configuration, 
the working window is divided in two: the objects (stations and modules) are dis- 
played in graphic form in the top part, and in tabular form in the bottom part. When 
programming the PLC, the top part of the working window contains the interface 
description of the block, and the bottom part the program. You use the working 
window to configure the hardware of the automation system, generate the user 
program, or configure the process screens for an HMI device. 
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@ Inspector window 


The inspector window underneath the working window shows the properties of the 
objects marked in the latter, records the sequence of actions, and provides an over- 
view of the diagnostics status of the connected devices. 


During configuration or programming you set the object properties in the inspec- 
tor window, for example the addresses and symbol names of inputs and outputs, 
the properties of the PROFINET interface, tag data types or block attributes. 


@ Project tree 


The project tree window is displayed with the same content for all editors. Its hier- 
archical structure contains all project data and the required editors. With the proj- 
ect open, it shows the folders for the PLC and HMI stations included in the project, 
and further subfolders within these folders, e.g. for program blocks, PLC tags, and 
watch tables with a PLC station or, for example, the process images and the HMI 
tags in the case of an HMI station. 


A double-click on an object with project data automatically starts the associated ed- 
itor. The project tree also includes editors such as Add new device, Device configura- 
tion, or Online & diagnostics, which you can start directly by means of a double-click. 


The lower section of the project tree contains a details view of those objects, which 
are present in the hierarchy underneath the object marked in the project tree. 


© Task window 


To the right of the working window is the task window with the task cards. This con- 
tains further objects for processing in the working window. The contents of the task 
window depend on the currently active editor. In the case of the hardware configu- 
ration, for example, the hardware catalog with the available components is shown 
here, in the case of PLC programming the program elements catalog appears, with 
online & diagnostics the online tools, and with the visualization the library for the 
process image control and display elements. 


You can also call the libraries in this window: Global libraries supplied with STEP 7, 
or the project library in which you can save reusable objects such as program 
blocks, templates for process images, or control elements with special configura- 
tions. 


© Editor and status bar 


At the bottom left of the Project view you can change to the Portal view. In the mid- 
dle you can see the tabs of the open windows. Clicking on a tab results in its contents 
being displayed in the top level of the working window. This makes it easy to change 
quickly between different window contents. The far right of the status bar indicates 
the current status of project processing. 
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1.2.7 Adapting the user interface 


The language of the user interface can be changed. In the main menu, select the sec- 
tion General under Options > Settings. In the User interface language drop-down list, 
you can select the desired language from the installed languages. The texts of the 
user interface are then immediately displayed in the new language. You can also de- 
fine here how TIA Portal is to be displayed following the next restart. 


You can show or hide the displayed window using the menu item View. You can al- 
ways change the size of windows by dragging on its edge with the mouse. Windows 
can be minimized into a symbol which appears in one of the navigation bars in the 
left, bottom or right margin of the screen. 


You can separate the working window completely from the Project view so that it is 
displayed as a separate window (symbol for Float in the title bar of the working win- 
dow), and also insert it again (symbol for Embed). Using the symbol for “Maximize” 
all other windows are closed, and the working window is displayed in maximum 
size. The working window can be divided vertically or horizontally, permitting you 
to view two working areas simultaneously. 


You can change the width of table columns by dragging with the cursor in the table 
header. In the case of columns that are too narrow, the entire content of the individ- 
ual cells will appear as a tooltip when the cursor is briefly hovered over the relevant 
field. 


1.3 Editing a SIMATIC project 


Fig. 1.16 shows all tools and data which can be of importance in an automation task. 
Of prime importance is the Project, which contains all the automation data required 
for control and operation of the machine or plant. The project data is roughly divid- 
ed into the data for the individual stations and the common project data which ap- 
plies to all stations in the project. 


A Station can be a controller (PLC station), an HMI device (HMI station), or a PC sta- 
tion. A project can include several stations, but at least one station must be present. 
The data present in a station is described later in this book. Common project data 
includes, for example, centrally managed message texts or texts for multilingual 
projects. 


A project library can be created for each project. Objects which are used in several 
projects are combined in global libraries. Also relevant to a project is the program- 
ming device design with interface modules (e.g. LAN adapters) and memory card 
readers. 
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All the data for the automation task is combined in a project. 


Stations Common project data 
A project includes at least one station. Contains cross-station data. 
PLC station Contains all the data for a Common data 
controller. 


Contains text lists for system and user messages. 


HMI station Contains all the data for an HMI 
device. 


Documentation settings 


PC station Contains all the data for a PC : ; 
system or PC application. Contains the templates and settings for 
documentation of project data 
Project library 
Contains data compiled by the user Languages & resources 
P : Contai ject text: ject I d 
< Project library > pal exts, project languages, an 


Programming device design 


Contains the programming device resources relevant to the project. 


Online access SIMATIC Card Reader 


Global libraries 


Global libraries contain elements for use across projects. 


System libraries User libraries 
Libraries delivered with STEP 7. Libraries configured by users themselves. 
< Global library > < User library > 


Fig. 1.16 Project components, libraries and programming device design 


1.3.1 Structured representation of project data 


The project tree in the Project view displays the project data and the programming 
device design in a tree structure (Fig. 1.17). 


The structure also includes the editors (tools) required for generating and editing 
the data. The project tree does not include the project library. This is represented in 
a task card together with the global libraries in the task window under “Libraries” 


You can replace the names shown in angle brackets by names more appropriate to 
your automation task. 


1.3.2 Project data and editors for a PLC station 


If you add a PLC station (an S7-400 controller) to the project, STEP 7 creates the cor- 
responding structure in the project data (Fig. 1.18). A station is always required for 
editing in a project so that STEP 7 can create the data structures required for pro- 
gramming or configuration. If you wish to write a user program without previously 
selecting a specific CPU, you can select an “unspecified CPU 400” from the hardware 
catalog and replace it later with a “real” CPU 400, if necessary. 


1 Introduction 


Project navigation with opened project 


< Project Folder for all data of an automation system 
Add new device Adds a new station to the project 
Devices & networks Starts the device and network configuration 
< PLC station > Folder for all data of a PLC station 
< PLC station_1 > Folder for the data of a further PLC station 
Common data Folder for common data in the project 
L 


Message classes, text lists for user and system messages 


Documentation settings Folder for common data in the project 


L ies Templates and settings for documentation 
Languages & resources Folder for language-dependent objects 


List with project texts in different languages 
Selection of languages for display and message texts 
Collection of language-dependent graphic symbols 


Online access Folder for all LAN interface modules of the programming device 
Interface x1 LAN interface of programming device 
Update accessible Searches for stations connected to this interface module 
stations 
<PLC...> Folder with the data of a found station 
Interface x2 Further LAN interface modules if applicable 


SIMATIC Card Reader Folder for all SD card readers of the programming device 


Add user-defined card reader Adds acard reader 


Card reader Card reader in the programming device 


Fig. 1.17 Project structure in the project tree 


The user program which controls the machine or process is located in the Program 
blocks folder. The program comprises blocks (separate program components) 
which are either stored directly in the Program blocks folder or — if there is a large 
number - in subfolders which you can create and configure yourself. The Main 
block (“main program”, the name is the symbol for the block and can be changed) 
is the organization block OB 1 and is created automatically. The processing se- 
quence of the blocks is defined in the user program by “block calls” and can be 
made visible using the Program info editor (further down in the project tree) in a 
call and dependency structure. 
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Data structure of a PLC station 


Folder for all data of a PLC station (name can be freely selected) 


< PLC_xxx > 


Device configuration 
Online & diagnostics 


Program blocks 


Add new block 


< Group_1> 
|— < Block_2> 


Main [OB1] 
< Block_1> 


System blocks 

Technology objects 

Add new object 

| < Technology object_1 > 
External sources files 

Add new external file 

< External program source > 
PLC tags 


Show all tags 


Add new tag table 
Standard tag table [n] 
< Tag table [n] > 


| <Group_1 > 


|— PLC tags (n) 
PLC data types 
z Add new data type 

< PLC data type_1 > 
Watch and force tables 


Add new watch table 
< Watch table_1 > 
Force table 


<Group_1 > 


a < Watch table_2 


Program info 
PLC alarms 


Text lists 


Local modules 


PLC module 
< Other modules > 


Starts the editor for the device configuration 
Starts the editor for the online connection and diagnostics 


Folder for all blocks of the user program 


Creates a new block and opens it 


Under Program blocks, further blocks can be created in 
addition to the permanently existing Main [OB1] block (main 
program). The block collection can be structured using self- 
created groups which contain further blocks. 


Self-created block 


Folder for the system blocks used 


Folder for all technology objects 
Creates a new technology object and opens it 


Self-created technology object 


Folder for the program sources 


Imports a process source 
Imported process source 


Folder for all PLC tags 


Shows all PLC tags of all tables 

Adds a new tag table 

Automatically created tag table with n tags 
Self-created tag table with n tags 


Self-created groups with further tag (partial) tables can be used 
under PLC tags for structuring. 


Folder for all PLC data types 

Adds a new PLC data type 

Self-created PLC data type 

Folder for all watch and force tables 


Creates a new watch table and opens it 
Self-created watch table 
Table with the force tags 


Self-created groups with more watch tables can be used under 
Watch and force tables for structuring. 


Shows program structure, assignment list, CPU resources 
PLC, user diagnostics and system messages 


Station-specific texts for user and system messages 


Folder for the local modules of the PLC station 


List of all local, configured modules of the PLC station 


Fig. 1.18 Structure of the project data for a PLC station 
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The Program blocks folder has a System blocks subfolder with the system and stan- 
dard blocks used in the program. This is created automatically when a block of this 
type is used. 


The Technology objects folder contains the configuration data for control loop 
objects (PID controllers). A new PID controller technology object can be generated 
as a technology object using the Add new object editor. 


The External sources files editor contains the program sources for STL and SCL 
blocks. The Add new external file editor is used to import a program source and to 
save it in this folder. The External sources files folder can be configured using self- 
created subfolders. 


The PLC tags folder contains the assignment of the absolute address to the symbol 
address (name) of inputs, outputs, and bit memories, as well as SIMATIC timer func- 
tions and SIMATIC counter functions. Example: The symbol address “Switch on mo- 
tor” can be assigned to the input with the absolute address %1I1.0. A PLC tag is ap- 
plicable throughout the CPU, it is a “global” tag. The PLC tags folder can be config- 
ured using self-created subfolders. A subset of the PLC tags is listed in a tag table. 
The Show all tags editor lists all PLC tags used from all tag tables. 


The PLC data types folder contains user-defined data types. A PLC data type com- 
bines various data types in the form of anamed data structure. A PLC data type can 
be assigned to a local tag in a block or serve as a template for the structure of a data 
block. The PLC data types folder can be configured using self-created subfolders. 


All created watch tables and the forced table can be found in the Watch and force 
tables folder. A watch table is used during testing of the user program. It contains 
tags whose current value can be monitored and also changed during runtime. 
The Force table can be used to assign a fixed value to peripheral inputs and outputs. 
The Watch and force tables folder can be configured using self-created subfolders. 


Program info provides information about 


the call structure shows the call sequence of the blocks - which block calls which 
other block 


the dependency structure - which block is called by which other block 


the assignment list - which global operands are already used, and which addresses 
are still unused 


the CPU Resources - how much space is required by the program in the load and 
work memory. 


Under PLC alarms you see an overview of which PLC alarms, user diagnostic alarms, 
and system alarms are currently present and edit them. 


Message texts are stored under Text lists. In the case of the user-defined text list, you 
can specify the value ranges which trigger the messages and the associated texts; 
with a system-defined text list, the contents are specified by STEP 7. Text lists creat- 
ed under a PLC station contain station-specific texts, those created under a project 
contain cross-station texts. 
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The Local modules folder contains all configured modules of the PLC station. Open- 
ing amodule initiates device configuration. The module properties are displayed in 
the inspector window. 


You start configuration of a station using the Device configuration editor which is 
located in the first position in the project structure. There is no corresponding fold- 
er for the data of the device configuration in the project tree. The configuration da- 
tais located “behind” the Device configuration editor. When you start the editor, the 
data is displayed in the form of a pictorial representation of the programmable con- 
troller in the working window and in a register-oriented representation of the mod- 
ule properties in the inspector window. The bottom section of the working window 
additionally displays the configuration table with the modules as a drop-down list. 


Online & diagnostics starts the editor for the online connection and online func- 
tions. For example, you can use a (software) control panel in online mode to control 
the operating states of the CPU, to set the CPU's IP address and time, or read the 
CPU's diagnostic buffer. 


1.3.3 Creating and editing a project 


Creating a new project 


You can create a new project in the Portal view if you click in the Start portal on 
Create new project. Assign a name to the project and set a path in which the project 
is to be saved. After clicking the Create button, any project which is open is closed, 
the new project is created, and the next steps are displayed in the Start portal for se- 
lection: 


> Configure a device 
STEP 7 changes to the Devices & networks portal in which you can insert a new 
CPU 400 (a PLC station) into the project and open it for editing. 


> Create a PLC program 
STEP 7 changes to the PLC programming portal in which you can edit the Main 
block (organization block OB 1) or insert a new block and open it for editing. 
Select a PLC station if applicable. This can also be an “unspecified CPU” which 
you can later replace by a CPU from the hardware catalog. 


> Configure an HMI screen (if WinCC is installed in the TIA Portal) 
STEP 7 changes to the Visualization portal in which you can create a new HMI 
station or configure an already existing one. From this portal you start configu- 
ration of the process images, editing of HMI tags and messages, and the HMI 
simulator. 


> Open the project view 
STEP 7 changes to the Project view in which you can carry out the next steps 
(insert and configure PLC station, insert and program block, or insert and con- 
figure HMI station). 
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In the project view you can create a new project using the Project > New menu 
command. Assign a name to the project in the dialog window, set the path in which 
the project is to be saved, and click on the Create button. 


Editing an existing project 


You can open an existing project in either the Portal view or the Project view. Either 
activate Open existing project in the Portal view or Project > Open in the Project view. 
Select the desired project from the list of projects last used. Any project which is 
open is closed, and the selected project is opened. 


During editing in the Project view, you can save the entered project data using the 
Project > Save or Project > Save as menu command. You can close the project using 
Project > Close - following confirmation of whether changes are to be saved — with- 
out exiting STEP 7. 


You can delete a (closed) project from the hard disk - following confirmation - 
using Project > Delete project. 


Compiling and downloading project data 


Before project data can be downloaded to a station, it must be made readable for the 
processor: They must be “compiled”. The project data is compiled station-by-sta- 
tion. The scope of the compilation can be varied depending on the type of station. 
For example, the command from the Compile > Software shortcut menu only com- 
piles those software components which have been changed since the last compila- 
tion. 


The same applies to downloading of the compiled data to a station. You can select 
for a PLC station whether you wish to download only the hardware configuration, 
or only the user program, or both. 


Printing project data 


The project data can be printed in the form of a circuit manual. You can use the doc- 
umentation function to set the layout of the printout. The settings in the main 
menu under Options > Settings and General > Print settings apply to all projects in 
the TIA Portal. The templates for the project circuit manual are saved in the project 
tree in the Documentation settings folder. You can add your own templates or 
change existing ones. 


In the global Documentation templates library under Copy templates in the Docu- 
ment information group are the templates to design a circuit manual; in the Frames 
group are the templates for the page frames; and in the Cover pages group are the 
cover page templates. To copy templates to the project, in the Libraries task card, 
open the Documentation templates library and drag a template from the Document 
information folder, for example DocuInfo_ISO_A4 Portrait, to the Document informa- 
tion folder under Documentation settings. Copy a cover page from the Cover Pages 
folder to the Deckbldtter folder and a frame from the Frames folder to the Rahmen 
folder. 
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Double-clicking on a template in the project tree opens the template for editing. For 
example, you add a new text field or graphical symbol to the cover page. You are 
supported by the Tools task card, which contains object templates for a text field, a 
date/time field, a field for the page number, a field for free text, and a graphic place- 
holder. In the frame template, you complete the title block and in the document in- 
formation template you enter the data for the circuit manual. 


You select the objects to be printed in the project tree or in a library. To display the 
print preview, select Print preview... from the shortcut menu or Project > Print pre- 
view... from the main menu. In the dialog window you can set the document infor- 
mation to be used, select the printout of the cover page and table of contents, and 
specify whether all project data or a compact selection should be displayed in the 
print preview. 


To print, select the objects to be printed and click on the Print icon in the toolbar or 
select Project > Print... in the main menu, or Print... in the shortcut menu. In the di- 
alog window, you then specify the printer, the document layout, and compact or full 
printout. 


1.3.4 Creating and editing libraries 


Libraries are used to save reusable program components. These could include sta- 
tions, blocks, PLC tag tables, process images, or picture elements, for example. A 
project library and global libraries are available. 


The libraries are displayed in a task card of the task window. The library contents 
can be listed with the symbol open or close the element view in the Elements pallet in 
the Details mode, List mode, or Overview mode. The Parts pallet shows the contents 
of the selected library element. 


A project library which you can fill with objects is automatically created when you 
create a project. You can structure the contents of the project library using folders. 
A project library is always opened, saved, and closed together with the project. 


Components which can be used in multiple projects are saved in global libraries. 
There are global system libraries which are supplied with STEP 7, and global user 
libraries which you create yourself. A global library is opened, saved, and closed in- 
dependent of the project. If you wish to use a global library simultaneously with 
other users, the library must be opened in read-only mode. 
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2 SIMATIC S7-400 automation system 


2.1 Components of an S7-400 station 


Fig. 2.1 
S7-400 programmable 
controller in a UR2 rack 


? 


A programmable controller including all I/O modules is referred to as a “station”. 
An S7-400 station can contain the following components: 

Rack 

Power supply (PS) 

Central processing unit (CPU) 

Interface module (IM) 

Input/output module (signal module SM) 


Function module (FM) 


Communication module (communications processors CP) 
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A station can also comprise distributed I/O connected to it over a bus system. 


Certain SIMATIC S7-400 modules are also available as SIPLUS version for particular- 
ly harsh environmental conditions. 


Design variants, racks 


An automation system (station) can consist of several racks interconnected by 
means of bus cables. The power supply, CPU, and I/O modules (SM, FM, and CP) are 
fitted in the central rack. If the space in the central rack is insufficient for all 
I/O modules, or if you wish to position I/O modules remote from the central rack, you 
can use expansion racks which use interface modules to establish the connection to 
the central rack (Fig. 2.2). It is additionally possible to connect distributed I/O to a 
station. 


The racks have a fixed number of single-width slots. There are modules with two 
slots, such as power supply modules or CPUs. The data exchange between the mod- 
ules takes place via the backplane bus. It comprises a parallel I/O bus (I/O bus for 
transferring user data) and a serial C bus (communication bus for transferring data 
records). 


Distributed configuration of an S7-400 station 


Central rack Connection in the close-up range up to 1.5 m: 
(CR) 2 x 1 ER per connection in the CR, for “basic” signal modules 
a il IM 461-1 
CR = Central rack 
in CR: ER = Expansion rack 
IM 460-1 IM = Interface module (connection) 


Connection in the close-up range up to 5 m: 
2 x 4 ERs per connection in the CR, for all I/O modules 


IM 461-0 IM 461-0 IM 461-0 IM 461-0 


in CR: 
IM 460-0 


Connection in the far range up to 102 m: 
2 x 4 ERs per connection in the CR, for all I/O modules 


IM 461-3 IM 461-3 IM 461-3 IM 461-3 


in CR: 
IM 460-3 


Fig. 2.2 Design variants of an S7-400 station 
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Depending on use, a distinction is made between three rack variants: 

> Universal racks (UR), can be used both in the central controller and in 
an expansion unit 

> Central racks (CR), can only be used in the central controller 

> Extension racks (ER), can only be used in an expansion unit 


The racks essentially differ in terms of the number of slots and the backplane bus 
(Fig. 2.3). 


Centralized configuration 
The following racks are available for the central controller: 


URI with 18 slots, end-to-end power supply, and end-to-end I/O bus and C bus 
UR2 with 9 slots, end-to-end power supply, and end-to-end I/O bus and C bus 
UR2-H with 9 + 9 slots, separated power supply, and separated I/O bus and C bus 


CR2 with 10 + 8 slots, end-to-end power supply, and end-to-end C bus, but 
with separated I/O bus 


CR3 with 4 slots, end-to-end power supply, and end-to-end I/O bus and C bus 


The power supply module is plugged into the first slot on the far left of the rack, a 
second redundant power supply module right next to it. Any modules may be oper- 
ated in the remaining slots. 


The UR2-H rack allows two independent central controllers to be combined as a sin- 
gle unit. This rack is suitable for setting up a high-availability automation system 
(H system). 


The CR2 rack allows two central controllers to be combined as a single central con- 
troller with shared power supply. The end-to-end C bus permits the exchange of da- 
ta between the CPUs via the backplane bus without additional wiring. 


The CR3 rack is suitable for a central controller whose I/O modules can only be con- 
nected via a distributed setup with expansion units or via distributed I/O with 
PROFIBUS and/or PROFINET. 


Distributed configuration 


The following racks are available for an expansion unit: 


URI with 18 slots, end-to-end power supply, and end-to-end I/O bus and C bus 
UR2 with 9 slots, end-to-end power supply, and end-to-end I/O bus and C bus 
UR2-H with 9 + 9 slots, separated power supply, and separated I/O bus and C bus 


ER1 with 18 slots, with end-to-end power supply and end-to-end I/O bus, but 
without C bus 


ER2 with 9 slots, with end-to-end power supply and end-to-end I/O bus, but 
without C bus 
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Racks of an S7-400 station 


Universal rack UR1 


On the universal racks UR1 (18 slots) 
and UR2 (9 slots) and the central rack 
CR3 (4 slots), all slots are connected to 
the I/O bus and C bus. 


On the far left of the rack, the power 
supply modules are located. The other 
modules, including the CPU module(s), 
can be inserted in the remaining slots. 


The universal rack UR2-H is divided into 
two segments with nine slots each. 

The complete backplane bus is divided 
so that a second power supply is 
required. 


The power supply modules are inserted 
on the far left of each segment; the other 
modules can be in any position. 


The 18 slots in the central rack CR2 are 
divided into segments of ten and eight 
slots. The IO bus is interrupted and only 
serves one segment. 


The power supply modules in the first 
slots power the entire rack. The CPU 
modules can exchange data via the C bus 
across segment boundaries without 
additional cabling. 


The expansion rack ER1 (18 slots) and 
ER2 (9 slots) are designed for “simple” 


bs signal modules. The I/O bus is present 
1/0 ! | | | | | i [ [ | j | [| i in all slots; the C bus is missing. 
bus 


The power supply modules are located 

on the far left in the rack; the interface 
module on the far right. The other modules 
can be in any position. 


Fig. 2.3 Racks for S7-400 


47 


2 SIMATIC S7-400 automation system 


An expansion unit is connected to the central controller via interface modules (IM): 
The transmit module (IM 160-x) is in the central controller and the receive module 
(IM 161-x) is in the expansion unit. In the central controller, a maximum of six 
transmit IMs can be operated, but only two of the IM 160-1 (see also Chapter 2.6.1 
“Interface modules” on page 59). 


A power supply module is inserted into the expansion module in slot 1 on the far 
left, aredundant, secondary power supply module right next to it. The receive IM is 
inserted into the last slot on the far right in the expansion module. A terminating 
connector is required on an open connection on the last interface module in the line 
(not on IM 161-1). 


The expansion racks ER1 and ER2 are designed for the use of “simple” signal 
modules that do not trigger hardware interrupts, do not need to be supplied with 
24 V DC via the I/O bus, do not require backup voltage, and do not have a C bus 
connector. 


Up to 21 expansion units can be connected to a central controller. The number of 
the expansion unit (1 to 21) is set at the coding switch of the receiving IM. Any 
number can be assigned to the expansion unit, but it must be unambiguous. Note 
that the data exchange via the C bus can only take place between the central con- 
troller and expansion units 1 through 6, which are equipped with a universal 
rack. 


2.2 S7-400 CPUs 


2.2.1 CPU versions 


CPUs for S7-400 are available in several versions for different applications. Com- 
mon to all CPUs is the scope of control functions (operands, tag types, data types, 
binary logic operations, fixed-point and floating-point arithmetic, etc.). Within the 
versions, the CPUs differ in their memory size, the quantity of operands, and the 
processing speed. 


Standard controllers 


The controllers of standard design range from the “smallest” CPU 412 for lower-end 
applications with moderate processing speed requirements up to the CPU 417-4 
with its large program memory and high processing performance for cross-sector 
automation tasks. Equipped with the relevant interfaces, the CPUs can be used for 
central control of the distributed I/O via PROFIBUS and PROFINET. 


Fail-safe controllers 


The fail-safe controllers are used in production plants with increased safety re- 
quirements. The relevant PROFIBUS and PROFINET interfaces allow the opera- 
tion of safety-related distributed I/O using the PROFlIsafe bus profile. Standard 
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modules for normal applications can be used parallel 
to safety-related operation (Fig. 2.5). 


Fail-safe automation systems control processes and 
machines with the objective of keeping the danger to 
persons and the environment as low as possible with- 
out limiting production more than absolutely neces- 
sary. Safety-related SIMATIC systems are used when 
the safe state can be achieved by switching off imme- 
diately. They comply with the following safety 
requirements: Safety integrity levels SIL1 to SIL3 in 
accordance with IEC 61508, and categories Cat. 1 to 
Cat. 4 in accordance with EN 954-1. 


The enhanced safety functions are essentially 
achieved by means of a safety-related user program in 
an appropriately designed CPU 400F, by means of fail- 
safe I/O modules, and by the higher-level PROFIsafe 
profile on the PROFIBUS DP or PROFINET IO “stan- 
dard” bus systems. 


Fig. 2.4 CPU 414-3 PN/DP 


Design for S7 Distributed Safety 


S7-400 with fail-safe controller 


Miririrarara 
with F modules 


Bus profile 
PROFIsafe 


ET 200S 


with F modules 


ET 200pro 
TEE 
PROFIBUS DP ae F oo 
or PROFINET IO 


Use of standard I/O modules 
as well as fail-safe I/O modules 
is possible in the distributed 
stations. 


Fig. 2.5 Design version for S7 Distributed Safety 
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2.2.2 Control and display elements 


The mode switch and the status LEDs are located on the 
front side of the CPU (Fig. 2.6). 


Mode switch 


The mode switch is designed as a toggle switch with the 
positions RUN, STOP, and MRES. In the RUN position, the 
user program is executed and the programming device 
has unlimited access to the CPU. 


The user program is not executed in the STOP position, 
but the CPU retains its communication capability. For ex- 
ample, anew user program can be downloaded using the 
programming device or the diagnostic buffer can be read 
out with the CPU at STOP. 


In the MRES position (master reset), the CPU parameters 
are reset. MRES functions like a pushbutton. Amemory __ Fig, 2.6 Control and 
reset can be carried out for the CPU using aspecialinput display elements ona 
sequence, or it can be reset to the delivered state. CPU 414-3 PNIDP 


Status LEDs 
The status of the CPU is indicated by means of LEDs: 


INTF red lights up if there is an internal software error or hardware fault 
EXTF red lights up if there is an external fault 

BUSIF red lights up if there is a bus fault at MPI/DP interface 1 

BUS2F red lights up if there is a bus fault at MPI/DP interface 2 

BUS5F red lights up if there is a bus fault at the PN interface 

IFM1F red lights up if there is a fault at IF module 1 

IFM1F red lights up if there is a fault at IF module 2 


FRCE yellow lights up if forcing is active, 
flashes at 2 Hz during the node flashing test 


MAINT yellow _ lights up if there is a maintenance request 


RUN green lights up in RUN mode, 
flashes at 0.5 Hz in HALT mode, 
flashes at 2 Hz in STARTUP mode 


STOP yellow lights up in STOP mode, 
flashes at 0.5 Hz if the CPU requests a memory reset, 
flashes at 2 Hz when the CPU is carrying out a memory reset 


If all LEDs flash, a CPU-internal system fault is present. 
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2.2.3 SIMATIC memory card 


The memory card (MC) is available as RAM memory card and 
as FLASH memory card in various memory sizes. The mem- 
ory size of the memory card should be at least as large as the 
work memory in the CPU and additionally sufficient for the 
non-execution-relevant parts of the user program. 


The memory card expands the load memory of the CPU. A 
(small) part of the load memory is available as RAM on the 
CPU. If you want to make larger program changes during the 
program test, you must expand the load memory with a RAM 
memory card. If you remove the memory card from the CPU, 
the data stored there will be lost, because the RAM memory 
card does not have a buffer. The RAM memory card draws the 
backup voltage from the battery buffer of the power supply 
or via the external buffer power supply of the CPU. 


Fig. 2.7 SIMATIC 
The data is stored in non-volatile form on a FLASH memory RAM memory card 
card (FEPROM). You use a FLASH memory card if you want to 
save the user program in a CPU retentively without backup voltage. You can write 
to a FLASH memory card in a suitable EPROM programming module or in the CPU 
with the entire user program. 


Beginning with version 5, a memory card has a serial number that can be read by 
the user program. This makes it possible to allow use of the user program only 
when the “correct” memory card is inserted (copy protection similar to a dongle). 


2.2.4 Memory areas in an S7-400 station 


Fig. 2.8 shows the memory areas in the programming device, in the CPU, and in the 
signal modules which are important for the user program. 


The programming device contains the offline data. This consists of the user pro- 
gram (program code and user data), the system data (e.g. hardware, network and 
connection configuration), and further project-specific data such as the PLC tag 
table and comments. 


The I/O modules contain memories for the signal states of the input and output 
signals. 


The online data consists of the user program and the system data which is located 
in three memory areas: in the load memory, in the work memory, and in the system 
memory. 


Load memory 


The load memory contains the complete user program including configuration da- 
ta (system data). The load memory comprises a (small) RAM area on the CPU and 
the RAM or FLASH memory on the memory card. A RAM load memory is supplied 
with the internal backup voltage. 
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Memory areas in an $7-400 station 


Central processing unit (CPU) 


Programming device Memory card (RAM or FLASH) 


Project 
Offline project data: 


> Hardware configuration 
> User program 
> Project information 


Signal modules 


0 


Load memory 
Online project data: 


> Hardware configuration 
> User program 
> Project information 


Code work memory 


> Execution-relevant parts 
of code blocks 


> Process input image 


RAM load memory 
Online project data: 


> Hardware configuration 
> User program 
> Project information 


Data work memory 


> Execution-relevant parts 
of data blocks 


> Temporary local data 


> Input signals 
> Process output image 
> Diagnostics buffer 

> Communication buffer 


t 


> Output signals 


System memory 


> Module and 
interruption stack 


> Bit memory 
> SIMATIC timer functions 
> SIMATIC counter functions 


Fig. 2.8 Memory areas for the user program 


The user program is always initially transferred from the programming device to 
the load memory, and then from there to the work memory. The program in the 
load memory is not executed as the user program. 


Access to the system data in the load memory is only possible using specific system 
functions, for example functions for changing the module parameters. Data blocks 
can be identified as “not relevant to execution”, and in this case they are not trans- 
ferred to the work memory. 


Work memory 


The work memory is designed as a fast RAM completely integrated in the CPU. The 
CPU's operating system copies the “execution-relevant” program code and the user 
data into the work memory. “Execution-relevant” is a property of the existing ob- 
jects, and is not tantamount to the fact that a specific code block is actually called 
and executed. The “actual” user program is executed in the work memory. 


The work memory of a CPU 400 consists of two parts: The code work memory con- 
tains the program code, the process image input and output, the diagnostic buffer, 
and the memory for the communication resources. The data memory, which is sup- 
plied with the backup voltage, contains the user data and the temporary local data. 


When uploading the user program to the programming device, the blocks are 
fetched from the load memory, supplemented by the current values of the data 
operands from the work memory. 
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System memory 


The system memory contains the operand areas bit memories, SIMATIC timer func- 
tions, and SIMATIC counter functions. In addition, the buffer memories for process- 
ing the user program blocks are located here. 


2.2.5 Bus interfaces 


The following bus interfaces can be present depending on 
the design of the CPU (Fig. 2.9): 


> MPI 


All CPUs 400 have an MPI connection (Multi Point Inter- 
face) via which the programming device is connected. 
The MPI can also be used for data transfer (station-in- 
ternal S7 basic communication) and for connecting 
operator control and display units. The MPI is always 
named X1. 


> DP interface 


The DP interface connects the CPU to the PROFIBUS DP 
bus system. The CPU can be either the DP master or a 
DP slave. If a CPU has two DP interfaces, DP slave mode 
is not possible at both interfaces simultaneously. The 
station-external S7 basic communication can be used 
to configure data transfer via a DP interface. A pro- 
gramming device or an operator control and display 
unit can also be connected to a DP interface. 


> MPI/DP interface 


Certain CPUs have a combined MPI/DP interface as the 
first connection. When delivered, the interface is con- 
figured as an MPI; if you wish to use itasaDPinterface, Fig. 2.9 The bus 


you must change the parameter settings. Connernone One 
CPU 416-3 PN/DP 


> PN interface 


The PN interface connects the CPU to the Industrial Ethernet bus system in 
PROFINET IO and PROFINET CBA modes. With PROFINET IO, the CPU can be op- 
erated as a controller or device in the PROFINET IO system. The PN interface has 
two ports which are connected together by a switch. This permits simple config- 
uration of a quasi-line structure on the Ethernet bus. A programming device or 
an operator control and display unit can also be connected to a PN interface. Data 
transfer to other devices is possible using open user communication over Indus- 
trial Ethernet. 


Routing of data records is possible via the MPI, DP and PN interfaces, i.e. data can 


be transmitted beyond the limits of subnets. These interfaces also support time 
synchronization. 
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The bus interfaces are numbered: X1 for the first interface (MPI or MPI/DP), X2 for 
any second interface (DP), and X5 for the PN interface with the ports P1 and P2. 


2.2.6 IF 964-DP interface module 


The IF 964-DP interface module represents a fully-fledged 
PROFIBUS DP interface and can be inserted into the inter- 
face slot of a CPU 400 with firmware version 4.0 or higher. 
The transfer physics of the interface correspond to RS 485; 
the interface is isolated and has a maximum transfer rate 
of 12 Mbit/s. 


With this interface module, a CPU 400 can be operated as 
DP master or as DP slave. Depending on the CPU used, the 
PROFIBUS master system can comprise up to 125 DP 
slaves. The interface module supports the functions con- 
stant bus cycle time, SYNC/FREEZE, and direct data ex- Fig. 2.10 IF 964-DP 
change. interface module 


2.3 Signal modules 


Signal modules (SM) are peripheral input/output mod- 
ules which establish the connection between the CPU and 
the machine or process. The following types of module 
are available for SIMATIC S7-400: 


> SM421_— digital input modules 
> SM422 — digital output modules 
> SM431 analog input modules 
> SM432 analog output modules 


The signal modules can be inserted into all universal and 
central racks and - with restrictions in some cases - into 
the expansion racks. 


2.3.1 Digital input modules 


The digital input modules are used by the CPU to record 
the operating states of the controlled machine or plant. 
These modules are signal conditioners for binary process 
input signals. Process signals present with a DC or AC 
voltage level from 24 V to 230 V are converted into sig- 
nals with an internal level. 


Depending on the module, the input channels are isolat- 
ed either individually or in groups. The module types in- Fig, 2.11 Digital 
clude simple input modules and modules with diagnostic input module SM 421, 
capability with hardware and diagnostic interrupt trig- DI32x24VDC 
gering (Table 2.1). 
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Table 2.1 Overview of digital modules 


Module type Short designation Description 


SM421 digital DI 32 x 24VDC All channels with shared root (root 32) 


input modules 


DI 16 x 24VDC alarm Root 8, hardware and diagnostic interrupt, 


parameterizable substitute values 


DI 32 x 120 V UC Root 8 


DI 16 x 120/230 V UC Root 4, input characteristic according to 


EC 1131, Type 2 


DI 16 x 24/60 V UC alarm Root 1, hardware and diagnostic interrupt 


SM422 digital DO 16 x 24VDC/2A Root 8 


output modules 


DO32 x 24VDC/0.5A Root 32 


Root 8, diagnostics, parameterizable substitute 
values 


DO 16 x 120/230 VAC/2A Root 4 


DO 16 x 30/230 V UC/ 5 A Rel 


The digital input modules have two or four bytes, corresponding to 16 or 32 input 
signals. All modules indicate the presence of a process signal by means of an LED 
on the input channel. 


2.3.2 Digital output modules 


The digital output modules are used by the CPU to control the connected machine 
or plant. These modules are signal conditioners for binary process output signals. 
The internal signals are amplified and output in the following current and voltage 
ranges (rated values): 


> With electronic amplifiers from 24 V DC and acurrent of 0.5 A and2A 
> With electronic amplifiers from 120 V to 230 V AC and a current of 2 A 


> With relay contacts with a DC voltage of 24 V or an AC voltage of 230 V and 
acurrent of up to5A 


Depending on the module, the output channels are isolated either individually or in 
groups. The module types include simple digital output modules, digital output 
modules with diagnostic capability, and modules with and without integral short-cir- 
cuit protection (Table 2.1). 


The digital output modules have two or four bytes, corresponding to 16 or 32 out- 
put signals. All modules indicate a delivered process signal by means of an LED on 
the output channel. 
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2.3.3 Analog input modules 


The CPU can use the analog input modules to process 
analog variables after they have been converted into 
digital values by the modules. These modules are sig- 
nal conditioners for analog process input signals. 


Voltage and current transmitters, thermocouples, re- 
sistors or thermoresistors can be connected to the 
modules depending on the design. The measuring 
range can be set as desired per channel or per channel 
group. The digital value is generated by integration, or 
with the SM 431-1KF20 by immediate conversion with- 
in 52 us per channel. Depending on the module, the 
resolution is up to 16 bits including sign. An analog 
value (a channel) occupies 16 bits, in other words two 
bytes. Analog input modules are available with 8 or 16 
channels, corresponding to an address range of 16 or 
32 bytes. 


Depending on the module, the input channels are iso- 
lated either individually or in groups. The module 
types include simple input modules, modules with di- 
agnostic capability with diagnostic interrupt trigger- 
ing, and modules which output a hardware interrupt 
when a limit is violated (Table 2.2). 


Table 2.2 Overview of analog modules 


Fig. 2.12 SM 331 analog 
input module, AI 8 


Module type Short designation Description 


SM431 analog Al 8 x 13 bit for voltage/current and resistance measurement 


input modules 


Al 8 x 14 bit for voltage/current and resistance measurement; for connection 
of thermocouples (TC) and resistance thermometers (RTD), 
with characteristic linearization 


sion time 52 us 


for voltage/current and resistance measurement; basic conver- 


Al 8 x 16 bit Isolated differential inputs for voltage/current temperature 
measurement, 26 measuring ranges, with characteristic linear- 
ization (TC), diagnostic and limit alarm 


Isolated differential inputs for resistance thermometers, with 
characteristic linearization (RTD), diagnostic and limit alarm, 
refresh rate 25 ms for 8 channels 


Al 16 x 13 bit for voltage and current measurement 


Al 16 x 16 bit for voltage/current/temperature and resistance measurement 
for connection of thermocouples (TC) and resistance thermo- 
meters (RTD), diagnostic, limit and end-of-cycle alarm 


SM432 analog AO 8 x 13 bit Conversion time 420 us at 1..5 V, 4..20 mA 
output module Conversion time 300 us at 0..10 V, +10 V, 0..20 mA, +20 mA 


56 


2.4 Function modules 


2.3.4 Analog output module 


The CPU can use analog output modules to continuously provide actuators with an- 
alog setpoints. These modules are signal conditioners for analog process output 
signals. 


The SM 432-1HFO00 module can output a voltage value (0 to 10 V, 1 to 5 V, or -10 to 
+10 V) or acurrent value (0 to 20 mA, -20 to +20 mA, or 4 to 20 mA). The resolution 
is 13 bits including sign. 


An analog value (an analog channel) occupies 16 bits, in other words two bytes. 
The analog output module has 8 channels, corresponding to an address range of 
16 bytes. 


The output channels are isolated from the load voltage and the backplane bus. 


2.4 Function modules 


Function modules (FM) are signal-preprocessing, “in- 
telligent” modules which prepare and process signals 
coming from the process independent of the CPU, and 
either return them to the process or make them avail- 
able at the CPU's internal interface. They are responsi- 
ble for handling functions which the CPU cannot usual- 
ly execute quickly enough, such as counting pulses, po- 
sitioning, or controlling drives. The following function 
modules are available: 


> FM450-1AP00 High-speed counter module 


Count up/down at a frequency up to 500 kHz, counting 
range 32 bits or +31 bits, 2 counter channels 


> FM451-3AL00 Positioning module 


Positioning for rapid-feed and creep-feed drives, adjust- 
ment of 3 independent axes with 4 digital outputs per 
axis for controlling contactors or frequency converters. 
Position detection can be carried out either incremen- 
tally or synchronous-serially. 


> FM 452-1AHO00 Electronic cam controller 


32 cam tracks with 128 cams and parameterizable cam 

characteristics (e.g. position-based or time-based cams) Fig. 2.13 FM451 
control 16 digital outputs. Position detection canbe car- Positioning module 
ried out either incrementally or synchronous-serially. 


> FM455-0VS0O0O Control unit, continuous controller 
FM 455-1VS0O0 Control unit, step or pulse controller 


PID controller with 16 channels (continuous) or 32 outputs (step/pulse). 
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2.5 Communication modules 


The communication modules (or communication 
processors (CP)) relieve the CPU of communication 
tasks. They establish the physical connection to a 
communication partner, take over establishment of 
the connection and data transport on this, and pro- 
vide the required communications services for the 
CPU and the user program. 


The following communication modules are available: 


D> 
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CP 440 Communication module for point-to- 
point coupling 

One interface; physical transmission properties 
RS 422/RS 485 (X.27); up to 32 participants; imple- 
mented protocols ASCII driver and 3964 (R); 


CP 441-1 Communication module for simple 
point-to-point coupling, one interface 

CP 441-2 Communication module for high-per- 
formance point-to-point coupling, two interfaces 


One or two slots for plug-in interface modules for 
the physical transmission properties RS 232C 
(V.24), 20 mA (TTY) or RS 422/RS 485 (X.27); Fig. 2.14 Ethernet connec- 
implemented protocols ASCII driver, 3964 (R) and __ tion CP 443-1 

printer driver; for CP 441-2 additionally RK 512 and 

reloadable customer-specific protocols; 


CP 443-5 Basic Communication module for connection to PROFIBUS 


Communication services: PROFIBUS FMS, PG/OP communication, S7 commu- 
nication, open communication (SEND/RECEIVE) 


CP 443-5 Extended Communication module for connection to 
PROFIBUS 


Use as DPV1 master; communications services: PROFIBUS DP, PG/OP commu- 
nication, S7 communication (client, server), open communication 
(SEND/RECEIVE) 


CP 443-1 Communication module for connection to Industrial Ethernet 


One interface with two ports and integral switch; with autosensing and 
autocrossover functions; communication services: PROFINET IO controller 
with real-time properties, PG/OP communication, $7 communication 
(client, server, multiplexing), open communication (TCP/IP and UDP); 


CP 443-1 Advanced Communication module for connection to Industrial 
Ethernet 


Two independent interfaces: Gigabit interface with one port, with autosensing 
function, PROFINET interface with four ports and integral switch, with auto- 
sensing and autocrossover function; 


2.6 Other modules 


Communication services via both interfaces: PG/OP communication, S7 commu- 
nication (client, server, multiplexing), open communication (ISO, TCP/IP, and 
UDP); IT communication (HTTP communication, e-mail client, FTP communica- 


tion, access to data blocks via FTP server); 


Communication services via PROFINET interface: PROFINET IO controller with 


real-time properties, PROFINET CBA; 


2.6 Other modules 


2.6.1 Interface modules 


The interface modules (IM) connect the central rack to an 
expansion rack or the expansion racks to each other. 


The interface modules are selected according to the max- 
imum distance between the central controller and the 
most distant expansion unit (in the line) (see also Figure 
2.2 “Design variants of an S7-400 station” on page 45): 


> IM 160-1/IM 161-1 


are suitable for installation in a control cabinet. The 
maximum distance is 1.5 m. An expansion unit can be 
operated on every connection of the transmit module. 
The supply voltage is also transferred (maximum 5 A) 
so that the power supply module can be omitted in the 
expansion unit. The IM 16x-1 interface modules trans- 
fer only the I/O bus to the expansion units. 


IM 160-0/IM 161-0 

are suitable for close range if the greatest distance is 
not more than 5 m. Up to four expansion units can be 
operated at each connection of the transmit module. A 
power supply module is required in every expansion 
unit. The IM 16x-0 interface modules transfer both the 
I/O bus and the C bus. 


IM 160-3/IM 161-3 

are designed for the far range of up to 100 m. Up to 
four expansion units can be operated at each connec- 
tion of the transmit module. A power supply module is 
required in every expansion unit. The IM 16x-3 inter- 
face modules transfer both the I/O bus and the C bus. 


Fig. 2.15 IM 160-3 
interface module 
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2 SIMATIC S7-400 automation system 


2.6.2 Power supply modules 


The power supply modules (PS) provide 5 V DC and 24 
V DC operating voltage for the modules in the rack. 


Depending on the power supply module, the primary 
voltage is either an AC voltage of 120/230 V (PS 407) or 
a 24 V DC voltage (PS 405). The various output specifi- 
cations for the power supply modules refer to the sec- 
ondary current for 5 V DC (4A, 10 A, or 20 A). 


The power supply modules do not provide load voltage 
for the signal modules. Here, individual power supply 
units are required. 


The LEDs on the front side indicate errors in the mod- 
ule and the buffer batteries, backup voltage that is too 
low, and the readiness of the operating voltages. 


The standby switch on the front side switches the sec- 
ondary voltages on and off; the FMR switch acknowl- 
edges an error message. The battery switch is used to 
set the LED display and the battery monitoring. 


Fig. 2.16 PS 40710A 
power supply 


Backup batteries 


The power supply modules have a battery compartment for one or two backup bat- 
teries. Use of these backup batteries is optional. 


If backup batteries have been installed, the RAM contents set as retentive will be 
backed up via the backplane bus if the power supply module is turned off or the 
supply voltage fails. The battery voltage must be within the tolerance range. In ad- 
dition, the backup batteries allow the CPU to be restarted after the mains voltage is 
switched on. 


Some power supply modules contain a battery compartment for two batteries. If 
you use two batteries and set the battery switch to 2BATT, the power supply module 
defines one of the two batteries as the backup battery. This assignment remains in 
force until the battery is empty. The system then switches to the reserve battery, 
which is then in turn used as the backup battery for the duration of its service life. 


Redundant power supplies 


Using two power supply modules of type PS 407 10A R or PS 405 10A R, you can de- 
sign aredundant power supply for a rack. Both modules are inserted alongside each 
other. The modules inserted into the rack must not draw more current than the 
power supply module can deliver. If one of the power supply modules fails, the oth- 
ers can continue operation without interruption. Each of the power supply modules 
can be exchanged during operation. 


The backup voltage is only set up redundantly if two batteries are installed in each 
of the two power supply modules. 
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2.7 SIPLUS S7-400 


SIPLUS extreme is the product range with hard- 
ened components for use in harsh environments. 
Many components of the standard SIMATIC S7- 
400 range are offered in the SIPLUS S7-400 range 
ina form adapted to extreme ambient conditions. 


The standard products are adapted individually. 
Two refined SIPLUS versions are available for 
SIMATIC S7-400 for: 


> Extended ambient temperature range 
(-25 ... +60 °C, partly +70 °C) and extraordinary 
medial load (conformal coating) 


> Extraordinary medial load (conformal coating) 


The digital input module SM 421 (32 DI x 24 V 
DC), the digital output module SM 422 (32 DO x 
24 VDC/O.5 A), the interface module IM 46x-0, and 
the power supply module PS 405 (10 A) from the Fig.2.17 SIPLUS CPU 416-3 PNIDP 
SIMATIC S7-400 range are available for anextend- with power supply 

ed ambient temperature range. 


The following are available for an extraordinary medial load: The central modules 
CPU 416 and CPU 417, analog signal modules SM 431 (16 AI x 13 bit) and SM 432 (8 
AO x 13 bit), function module FM 450-1, and power supply modules PS 407 (10 A) 
and PS 407 (10 A) R. 


SIPLUS modules are manufactured on request for the desired environmental con- 
ditions. Please therefore note the technical specifications for the module con- 
cerned. 


Configuration of SIPLUS modules 


The functionality of a SIPLUS module is the same as that of the corresponding stan- 
dard module; the Order No. (MLFB, machine-readable product code) commences 
with 6AG1.... SIPLUS modules are not included with their Order Nos. in the hard- 
ware catalog of the STEP 7 programming software. 


Since the SIPLUS modules have the same functions as existing modules, you can 
use the corresponding equivalent type (the standard module) when configuring. 
This equivalent type can be found on the device's nameplate, in the SIPLUS data 
sheets, and on the Internet in the Siemens A&D Mall area. 


If you select a module in the hardware catalog of STEP 7, the information on the 
module also shows whether this module is available as a SIPLUS type. 
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3 Device configuration 


3 Device configuration 


3.1 Introduction 


Device configuration entails planning the hardware design of your automation sys- 
tem. Configuration is carried out offline without a connection to the CPU. You can 
use this tool to add PLC stations to a project and equip these with modules which 
you then address and parameterize. You also use this tool to carry out the network- 
ing of PLC stations or the creation of distributed I/O stations. 


This chapter primarily describes the configuration of an individual PLC station 
with a CPU 400 standard controller, and provides an overview of the networking op- 
tions. Configuration of the distributed I/O is described in Chapters 16.4 “PROFIBUS 
DP” on page 649 and 16.3 “PROFINET IO” on page 636. 


Starting 


You can start the device configuration in the Portal view when setting-up a new 
project if the Open device view checkbox is activated following addition of a CPU. 
When opening an existing project, start the device configuration by selecting 
Configure a device. 


In the Project view, you can start the device configuration in the project tree by 
double-clicking on the Devices & networks editor under the project or on the Device 
configuration editor under the PLC station. 


The Device view tab shows the station (device) racks. You add a station to the project 
in this view and configure it. The Network view tab shows the networking between 
multiple stations. In this view you can add further subnets and stations, and con- 
figure their networking (described in Chapter 3.4 “Configuring the network” on 
page 74). In the Topology view tab you configure the geographic arrangement of the 
Ethernet network (described in Chapter 16.3.6 “Real-time communication with 
PROFINET IO” on page 647). 


Working in the Device view 


The device configuration shows one or more racks with the modules which have al- 
ready been positioned. If several PLCs are present in the project, select the device 
you wish to edit in the toolbar of the working window. 


You can now drag new modules with the mouse from the hardware catalog to arack, 
or remove existing ones. In the inspector window you can set the properties of the 
selected module such as the interrupts of the CPU or the addresses of the input/out- 
put modules. 
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3.1 Introduction 


Working in the Network view 


The Network view shows the stations present in the project and their networking. 
With the Network button activated, you connect two devices into a network by se- 
lecting an interface in a station and dragging it with the mouse to another station. 
A subnet is then created automatically. You can connect a station to an existing sub- 
net by dragging the interface with the mouse to the subnet. With the Connections 
button activated, you define a connection by selecting a subnet and then the type 
of connection from the drop-down list; alternatively, the type of connection is de- 
termined during programming of the communication functions, for example with 
open user communication. 


You set the properties of the selected objects in the inspector window, e.g. the line 
configuration and the bus parameters, when networking with PROFIBUS. 


Working in the Topology view 


The Topology view shows the networking between the stations on the Ethernet bus 
system. The connections between the device ports are shown. The connections can 
be created, changed, or deleted. 


In online mode, the Topology view shows the differences between the reference and 
actual topologies. A topology present online can be adopted offline as configuration 
information. 


Save, compile, and download 


You save the entered data on the hard disk by saving the complete project, using the 
Project > Save command in the main menu). In order to download the configuration 
data to a CPU, it must first be compiled in a form understandable to the CPU (using 
Edit > Compile). Any errors occurring during compilation are indicated in the 
inspector window under Info. Only error-free (consistent) compilations can be 
downloaded to the CPU using Online > Download to device. 


Upgrading and support 


To subsequently install device master data files (GSD), select Options > Install gen- 
eral station description file (GSD) in the main menu. Enter the source path in the 
subsequent dialog, and select the file to be installed. 


To subsequently install support packages, for example hardware support packages 
(HSP), select Options > Support Packages in the main menu. The Detailed informa- 
tion window displays the installed products and components as well as operating 
system information. Under Installation of Support Packages, you can select whether 
you wish to download the update from the Internet or from the file system. 


Working area of the device configuration 


The device configuration shows the project in the Project view. Fig. 3.1 shows the 
working area of the device configuration without project tree. 
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Fig. 3.1 Example of working area of device configuration (Device view) 


Three views are available in the Working window: 


> The Device view shows the current configuration of the PLC station. The config- 
uration is shown as a graphic in the top part of the window, and as a table in the 
bottom part. 


> In the Network view you can see - if more than one station is present in the proj- 
ect — the connections between the stations, also as a graphic in the top part of the 
window and with the existing stations and their interconnections as a table in the 
bottom part. 


> You can use the Topology view to display and configure the port connections with 
an Ethernet network as a graphic in the top part of the window and as a table in 
the bottom part. 


In all cases, you can “fold shut” the bottom part of the working window. 


The Inspector window is positioned below the working window. In the Properties 
tab, this shows the properties of the object selected in the working window. The Info 
tab contains general information on the configuration session and the compilation, 
and the cross-reference list. The Diagnostics tab shows the operating mode of the 
stations and the alarm display. 
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3.2 Configuring a station 


The Hardware catalog is available on the right in the task window. It shows all 
hardware components which can be configured with the current version of STEP 7. 
If you select a component in the lowest level of the hardware catalog, a brief 
description of the most important properties is shown in the information area of 
the hardware catalog. 


You can change the size of all windows. You can “fold shut” all windows except the 
working window and thus provide more space for the latter. The working window 
can also be maximized and displayed as a separate window. 


3.2 Configuring a station 


“Configuring” is understood to be the addition of a station to the project or, with a 
PLC station, the arranging of the modules in a rack, and the fitting of modules with 
submodules. 


3.2.1 Adding a PLC station 


When creating a new project, you normally add a PLC station at the same time. You 
can add further PLC stations in both the Portal and Project views. In the Portal view, 
you can add a new station in the Devices & networks portal using the Add new device 
command. In the Project view, double-click on Add new device in the project tree. 


Select the desired CPU in the selection window, and assign it a meaningful name. 
Before clicking on the OK button, make sure that the Open device view checkbox is 
activated in the window at the bottom left (Fig. 3.2). 


You have now configured a rack UR1 with a CPU inserted in slot 2. Slot 1 on the far 
left is intended for the power supply module. If you want to use a power supply 
module that occupies two slots or an additional redundant power supply, “move” 
the selected CPU with the right mouse button pressed to another slot. 


If you want to use another universal rack or central rack, select the rack in the work- 
ing window, choose Switch > device... from the shortcut menu, and specify the new 
rack in the subsequent dialog. 


3.2.2 Adding a module 


If you have not already done so, open the PLC station in the Device view. To insert a 
module, select it in the hardware catalog (the symbol of the module in the lowest 
catalog level). You are then provided with a description of the selected module in 
the information window of the hardware catalog. The permissible slots in the rack 
are highlighted. You position the new module by double-clicking on the module 
symbol or by dragging it with the mouse to the rack. 


If you activate the Filter checkbox in the hardware catalog, only modules from the 
selected device family will be shown, in our case only modules for SIMATIC S7-400. 
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Fig. 3.2 Selection window Add new device 


The I/O modules can be assigned to any slots (except for slot 1) - even with gaps. You 
can delete an inserted module again (remove it from the rack) or replace it by a dif- 
ferent, equivalent one. 


3.2.3. Adding an expansion unit 


You increase the number of I/O modules in the station with an expansion unit. You 
can use universal racks or expansion racks for the expansion unit. An ER1 or ER2 
expansion rack equipped only with an I/O bus is sufficient for “simple” signal mod- 
ules. For all other modules, use a UR1 or UR2 universal rack that additionally has 
the C bus. Note that you can only use the C bus in the expansion units 1 through 6. 
You can set the number of the expansion unit at the coding switch on the receiving 
interface module. 
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3.3 Parameterization of modules 


In the hardware catalog under Racks, double-click on a rack icon on the lowest level 
or drag the icon into the working window. An empty expansion unit is displayed. 
The connection from this expansion unit to the central controller is established 
with interface modules. 


Place the IM 460-x transmit interface module in the central controller and the IM 
461-x receive interface module in the expansion unit. Select the interface modules 
according to the distance between the central controller and the expansion unit and 
the transferred buses (see also Chapter 2.6.1 “Interface modules” on page 59). 


To place the interface module in the central controller, select the transmit IM under 
IM > Sender >... and drag it to a free slot in the central controller, for example the 
one on the far right. To place the interface module in the expansion unit, select the 
receive IM belonging to the transmit IM under IM > Receiver > ... and drag it to the 
last slot on the far right in the expansion unit. You connect the two interface mod- 
ules by selecting a connection on the transmit IM and dragging it to the upper con- 
nection of the receive IM. 


Depending on the transmit IM, you can arrange additional expansion units in the 
same line. Drag the rack for the next expansion unit from the hardware catalog to 
the working window and place the appropriate receive IM in its last slot. To connect, 
drag the lower connection of the receive IM in the already configured expansion 
unit to the upper connection of the receive IM in the new expansion unit. 


3.3. Parameterization of modules 


“Parameterization” or “assigning parameters” is understood to be the setting of 
module properties. These include, for example, setting addresses, enabling inter- 
rupts, or defining communication properties. 


Module parameterization is carried out for a selected module in the inspector win- 
dow in the Properties tab. Select the properties group on the left side, and set the 
values in interactive mode on the right. You can stop the setting of properties at any 
time and continue later. 


Only a portion of the total parameters described below can be assigned to individ- 
ual modules. 


3.3.1 Parameterization of CPU properties 


The CPU's operation system operates with the default settings for program execu- 
tion. You can change these default settings in the hardware configuration during 
parameterization of the CPU and match them to your specific requirements. Subse- 
quent modification is possible at any time. 


When starting up, the CPU adopts the settings deviating from the default settings 
in STARTUP mode. These settings then apply to further operation. 
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3 Device configuration 


To parameterize the CPU properties, select the CPU in the working window of the 
device configuration. If the project contains several stations, select the desired sta- 
tion in the menu bar of the working window. 


Set the name of the PLC station in the General section, and the module ID under 
Identification & Maintenance. Using the higher level designation, you can identify 
the CPU according to its function in the plant, for example, and you can use the 
location designation - which can be part of the equipment designation - to de- 
scribe the arrangement of the PLC station on the machine or within the plant. You 
can read out this data online using a programming device or evaluate it in a pro- 
gram using the system function RDSYSST (reading of system status list with SSL_ID 
W#16#011C and the index W#16#0003 for the higher level designation and 
W#16#000B for the location designation). 


In the MPI section you set the connection to an MPI subnet, the node address, the 
diagnostic address, and the network parameters. For more information, refer to 
Chapter 3.4.5 “Configuring an MPI subnet” on page 80. With a combined MPI/DP 
interface, first select the interface type (MPI or DP) and then set the corresponding 
properties. 


In the DP interface section you set the connection to a PROFIBUS subnet, the node 
address, the diagnostic address, the operating mode (master/slave), and further 
properties such as sync/freeze. You define the network parameters in the Proper- 
ties tab of the inspector window in the Network view with the PROFIBUS subnet se- 
lected. For more information, refer to Chapter 3.4.6 “Configuring a PROFIBUS sub- 
net” on page 81. You make the same entries when you configure the properties of 
the IF 964-DP interface module. 


In the PROFINET interface section you set the connection to an Ethernet subnet 
and define the IP address, the subnet mask, and the diagnostic address of the inter- 
face. Under Port you can find the transmission settings and the diagnostic address 
of the port (connection). For more information on the format of the IP address, 
refer to Chapter 3.4.7 “Configuring a PROFINET subnet” on page 82. 


You can set the startup characteristics of the CPU under Startup (Fig. 3.3). With the 
Startup if preset configuration does not match actual configuration checkbox activat- 
ed, the CPU still starts even if the actual hardware configuration deviates from the 
set configuration. As startup after POWER ON you can select between hot restart, 
warm restart, and cold restart. You can block the manual hot restart and, if the hot 
restart is not blocked, determine whether the outputs should be reset on startup. 
The duration for module parameterization is monitored during a startup; you can 
set the monitoring times. A module is considered to be absent if the monitoring 
time for it expires. 


In the Cycle section, you set the automatic OB1 process image update, define the 
cycle monitoring time, which is signaled if it is exceeded and can lead to the STOP 
operating state, and specify the minimum cycle time, which indicates the minimum 
duration of program cycle processing. In the Cycle load due to communication sec- 
tion you define the time share for communication. In addition to execution of the 
user program, the CPU also carries out communication tasks, for example data 
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3.3 Parameterization of modules 
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Fig. 3.3 Startup parameters with a CPU 400 


transmission to another PLC station or downloading of blocks from a programming 
device. This communication requires time, some of which has to be added to the ex- 
ecution time of the main program. Specification of the communication load can be 
used to control influencing of the cycle time to a certain extent. The time available 
for communication is entered as a percentage with this parameter (communication 
load). The cycle time is then extended by the factor 100 / (100 - communication 
load). 


In the Cycle section you can also set the size of the process image for the inputs and 
outputs — if the CPU supports this function — and define the response of the organi- 
zation block OB 85 in the event of an I/O access error during automatic updating of 
the process image. 


Clock memories change their signal state controlled by the system at frequencies 
from 0.5 Hz to 10 Hz. During parameterization of the CPU you activate the clock 
memories and assign an address to them. Further information on bit memories in 
general and on clock memories can be found in Chapter 4.1.3 “Operand area: bit 
memory” on page 92. 


In the Interrupts section you activate and parameterize event-driven processing. 
Further information on interrupts can be found in Chapter 5.6 “Interrupt process- 
ing” on page 196. 


Under Diagnostics system you can use the Signal cause of STOP checkbox to acti- 
vate output of a message to the logged-on display units when the CPU changes to 
the STOP state. 


Under System diagnostics you can activate the system-internal diagnostics func- 
tions (see Chapter 5.8.5 “System diagnostics with Report System Errors” on page 
231). Under Advanced settings you can define which organization blocks are to be 
created and with which events the CPU is to switch to the STOP operating state. 


In the Clock section you can set the correction factor and the type of synchroniza- 
tion. 
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3 Device configuration 


Under Retentivity you can set which areas of the bit memories and the SIMATIC 
timer and counter functions are to be retentive. 


In the Memory section you can assign the available amount of temporary data to 
the individual priority classes (the organization blocks). The minimum amount is 
20 bytes. Enter zero bytes to deselect the relevant priority class. Under Communica- 
tion resources you set the maximum number of communication jobs. 


In the Protection section you can protect the program in the CPU from unautho- 
rized access. Here you select whether access protection is to be switched on, and 
whether this is to be just write protection or combined read/write protection. Assign 
a password if the read or write protection is activated. Anyone in possession of the 
password has unlimited access to the CPU. 


In the Web server section you can activate the Web server and set its properties. 
Further details can be found in Chapter 18.4 “Web server” on page 727. 


The assigned inputs and outputs are shown in the Overview of addresses. The ad- 
dresses of the configured modules, the slots, and - if applicable - the number of the 
PROFIBUS master system or PROFINET IO system used are displayed. 


3.3.2 Addressing modules 


Slot address, geographic address 


Every slot in a PLC station has a fixed address. This slot address is made up of the 
rack number and the slot number. A module is unequivocally defined by the slot 
address (“geographic address”). 


If interface submodules are present on the module, each submodule is assigned an 
additional module address. In this manner, every binary signal, every analog sig- 
nal, and every serial connection in the system can be addressed unequivocally. 


In the same manner, modules of the distributed I/O also have a “geographic” 
address. In this case, the number of the DP master system or PROFINET IO system 
and the station number replace the rack number. 


By positioning a module on arack in the hardware configuration, you automatically 
define the slot address. The CPU's operating system requires the slot address in 
order to explicitly address a specific module, e.g. during parameterization. The slot 
address is not usually required in the user program, and is not used either. 


Logical address, user data address 


Every peripheral byte is addressed by a number, the “logical” address. This logical 
address defines the slot, and this corresponds to the absolute address. This is also 
referred to as the user data address since you can use this address to access the user 
data of the input/output modules in the user program, either via the process image 
(inputs I and outputs Q) or directly on the modules (peripheral inputs I:P and 
peripheral outputs Q:P). The range of logical addresses commences at zero and 
ends at a CPU-specific upper limit. 
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3.3 Parameterization of modules 


In the hardware configuration, a logical address is assigned to each byte of a used 
module. As standard, STEP 7 assigns the addresses starting at zero, but you can 
change the proposed address. 


Module start address 


The module start address is the smallest logical (user data) address of a module; it 
identifies the relative byte zero of the module. The following module bytes are then 
occupied consecutively with the logical addresses. 


Using the hardware configuration you determine the position of the user data 
addresses of a module in the address volume of the CPU by specifying the module 
start address. The lowest logical address is the module start address, also for mod- 
ules of the distributed I/O and even for the virtual slots in the user data interface of 
an intelligent DP slave or an intelligent IO device. 


In the case of modules which have input and output areas, the lower area start ad- 
dress is defined as the module start address. If the input and output areas have the 
same start address, use the input address. 


The module start address is used in many cases to identify a module. It has no spe- 
cial significance further to this. 


Configuring user data addresses 


When configuring the modules, STEP 7 automatically assigns a module start ad- 
dress. You can see this address in the configuration table in the bottom part of the 
working window or in the properties of the selected module in the inspector win- 
dow under I/O addresses. You can change the automatically assigned addresses (Fig. 
3.4). 
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Fig. 3.4 Example of parameterization of I/O addresses 


The logical addresses of the individual modules - independent of whether they are 
centrally located or belong to the distributed I/O - must not overlap. For the input 
and output modules, the logical addresses are assigned separately so that an input 
byte can have the same number as an output byte. 
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3 Device configuration 


The digital modules are usually located in the process image with regard to their 
addresses, meaning that their signal states are updated automatically and that they 
can be addressed with the input (I) and output (Q) operand areas. Analog modules, 
FM modules, and CP modules usually have an address which is not in the process 
image. You must access the user data of these modules via the peripheral operand 
area (I:P or Q:P). However, you are always able to freely select the module address 
within the CPU's address volume. 


If the CPU supports process image partitions, you can assign the addresses of a 
module to a process image partition. The user data can then be updated in the user 
program with the system functions SFC 26 UPDAT_PI and SFC 27 UPDAT_PO. 


Diagnostic address 


Appropriately configured modules can deliver diagnostic data which you can eval- 
uate in the user program. If central modules have a user data address (module start 
address), you access the module by means of this address when reading the diag- 
nostic data. If a module or submodule does not have a user data address, for exam- 
ple an interface module, a diagnostic address is available for this purpose. 


The diagnostic address is always an address in the I/O input range and takes up one 
byte. The user data length of this address is zero; if it is located in the process image 
(which is certainly permissible), it is not taken into consideration by the CPU when 
updating the process image. 


During hardware configuration, STEP 7 automatically assigns the diagnostic 
addresses in descending order starting with the highest possible logical address. 
You can change the diagnostic address with the hardware configuration. 


The diagnostic data can only be read using special system functions; access to the 
diagnostic address using load statements has no effect. 
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Fig. 3.5 Example of parameterization of an digital output channel 
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3.3 Parameterization of modules 


3.3.3 Assigning parameters to signal modules 


You set the following parameters in addition to the module start address for appro- 
priately designed signal modules. 


Digital input modules: For an alarm-triggering input module, go to the Inputs sec- 
tion and release the diagnostic alarm and - if available - the hardware interrupt. 
You can select for the channels which event is to trigger the diagnostics and hard- 
ware interrupts. The input delay defines the resistance of an input signal to high- 
frequency noise signals. 


Digital output modules: In the case of an interrupt-triggering output module, en- 
able the diagnostics interrupt in the Outputs section and define the trigger event: 
wire break, absence of load voltage, short-circuit to ground or to load voltage. You 
can define the response in the STOP operating state: retain the last value or connect 
a substitute value (Fig. 3.5). 


Analog input modules: In the case of an interrupt-triggering input module, you 
enable the diagnostic and hardware interrupt and define the trigger event. For ex- 
ample, you can set the measuring type, measuring range, interference frequency 
suppression, and smoothing for the channels (Fig. 3.6). 


Analog output modules: Set the output type (deactivated, voltage, or current) and 
the output range at the channels. 


-Q Properties i} Info | Diagnostics 


General 


> General 


Channel 0 
y Inputs 
Channel 0 Diagnostics 
Channel 1 
Channel 2 {_] Wire break 
Channel 3 
Channel 4 
Channel 5 q Measuring type: | Voltage \~ 
Channel 6 L : — = 
Measuring range: | +/-10V ad 
Channel 7 | 
VO addresses r — 
Interference frequency : 
suppression: | 50 Hz|¥ 
i ms | 


Smoothing: | none I 


Fig. 3.6 Example of parameterization of an analog input channel 
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3 Device configuration 


3.4 Configuring the network 


3.4.1 Introduction, overview 


The network configuration permits the graphic display and documentation of the 
configured networks and their stations. Configuration of the networking is part of 
the device configuration. If a PLC station is operated on its own — without an HMI 
station and without data communication to other PLC stations - the network con- 
figuration is not required. Connection of a programming device for transfer of the 
user program and for program testing does not require configuration either. 


You can access network configuration with the project opened in the Portal view via 
Devices & networks and Configure networks or in the Project view with the Devices & 
networks editor which is positioned in the project tree underneath the project. In 
the working window of the device configuration, change to the Network view tab 
(Fig. 3.7). 


In the top part of the working window, the Network view graphically displays all 
PLC, PC, and HMI stations present in the project as well as the networking, provided 
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Fig. 3.7 Example of working area of network configuration (Network view) 
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3.4 Configuring the network 


this has already been configured during device configuration. The bottom part of 
the working window contains the Network overview, Connections and I/O communi- 
cation tabs. You can drag further stations with the mouse from the hardware cata- 
log into the working area and thus add them to the project. The inspector window 
shows the properties of the selected object. 


3.4.2, Networking stations 


“Networking” of stations corresponds to the wiring of modules with communica- 
tion capability, i.e. a mechanical connection is established. A logical connection is 
additionally required in order to transfer data on the cable. The logical connection 
defines the transmission parameters between the modules. 


The working window of the network configuration editor shows the existing sta- 
tions with the modules with communication capability. The interfaces for the MPI, 
PROFIBUS, PROFINET, and AS-Interface subnets (for S7-300) are highlighted. Any 
existing CP modules are located on the right next to the CPUs, even if they are in- 
serted in an expansion unit. 


Adding a station in the network configuration 


In the hardware catalog under PLC > SIMATIC S7-400 > CPU > [folder: CPU 4xx...] > 
[CPU], select the desired CPU and drag it with the mouse into the working area. The 
graphic shows the CPU as a representative for the complete PLC station with the ex- 
isting bus interfaces. 


If you drag the CPU to an existing subnet and if the CPU has an interface matching 
the subnet, the interface is directly connected to the subnet when adding. 


An S7-400 station added in this way has as its rack the UR1 universal rack. You 
change the rack if you drag the desired rack from the hardware catalog to the sta- 
tion. 


Adding a communication module in the network configuration 


In the hardware catalog under PLC > SIMATIC S7-400 > Communication modules > 
[folder: Subnet] > [folder: Modules] > [Module], select the desired communication 
module and drag it with the mouse into the station graphic on the working area. 
The module is shown with the existing bus interfaces in the PLC station next to the 
CPU. 


A CP module added in this manner is positioned by the editor in the lowest vacant 
slot in the rack. 


If you drag the CP module to an existing subnet and if the CP module has an inter- 
face matching the subnet, the interface is directly connected to the subnet when 
adding and the CP module is displayed individually as a graphic. In the Device view, 
the CP module is then positioned in a rack which is otherwise empty. 
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3 Device configuration 


Adding a subnet 


Select the desired bus interface in the station graphic and then select the Add sub- 
net command from the shortcut menu. A subnet corresponding to the bus interface 
is added. 


Networking a station 


To network stations, click on the Network button in the toolbar of the working 
window. 


If a subnet has not yet been created, select the bus interface in one of the stations 
and drag it to a bus interface of the other station which matches the subnet. The 
subnet is then added; the interfaces are connected by a colored line. 


If the matching subnet is already present, select the bus interface in the station and 
drag it to the subnet. The interface is connected to the subnet by a colored line. 


Before networking a combined MPI/DP interface, set MPI or DP as the interface type 
in the interface properties. 


Properties of the Ethernet network 


The network configuration shows the Ethernet connections between several sta- 
tions as a linear bus connection: all stations are hanging quasi on one line. Actual- 
ly, an Ethernet connection is a point-to-point connection between the stations: 
each station is connected to exactly one partner station. The PROFINET interface of 
a CPU 400 has two ports which are connected together by an integrated switch. A 
linear network can thus quasi be set up. 


Modules without this integrated switch must be networked together via an external 
“distributor” with several connections. You can find these devices in the hardware 
catalog under Network components > IE switches > [Group] > [Device type] > [Device]. 


The individual ports are shown in the topology view, and you can then interconnect 
them and set their properties. 


Disconnecting a module from the subnet or assigning it to a different subnet 


If you wish to disconnect a module from the subnet, select the bus interface and 
then the Disconnect from subnet command in the shortcut menu. If all modules 
have been disconnected from a subnet, it is shown as an isolated subnet at the top 
left in the working area. 


If you wish to assign a module to a new subnet, select the bus interface and then the 
Assign to new subnet command in the shortcut menu. If several suitable subnets are 
available, select the appropriate one from the displayed list. 


3.4.3 Node addresses in a subnet 


Each module - each “node” - connected to a subnet requires an unambiguous ad- 
dress on the subnet (the “node address”) with which the module can be addressed 
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3.4 Configuring the network 


within the subnet. When assigning node addresses, attention must be paid to the 
particular properties of the associated subnet. 


Display of node addresses 


To display the node addresses in the Network view, click in the toolbar of the work- 
ing window on the Display addresses icon. The Network view shows the name of the 
subnet and the node address. If the bus interface is not connected to a subnet, only 
the node address is displayed (Fig. 3.8). 


HMI1 


KTP600 Basic PN 


PN/IE_1: 192.168.2.3 


PLC_1 
CPU 412-2 PN 


PLC_2 
CPU 416-3 PNIDP 


MPI_1: 2 
PN/IE_1: 192.168.2.1 


10 device_1 
IM 154-4 PN HF 


PLC_1 


PLC_3 
CPU 319-3 PNIDP 


Slave_1 
IM 151-1 HF 


PLC_2 


PROFIBUS_1: 3 PROFIBUS_1: 4 PN/IE_1: 192.168.2.5 


PN/IE_1: 192.168.2.2 


Fig. 3.8 Display of node addresses in the Network view 


Setting node addresses 


When networking a module, the editor automatically claims the next unused node 
address for the bus interface. You can change this automatically assigned address 
in the module properties in the inspector window with the bus interface selected. 


3.4.4 Connections 


Introduction 


A physical connection and a communication connection (logical connection) are 
required for communication between two devices. 


The physical connection is established by “networking” during the configuration. 
The networking represents the cabling, even in the case of wireless transmission. 
The networking is represented graphically by the subnets. 


Data transmission over the network requires a communication connection (logical 
connection). The logical connection defines the transmission parameters between 
the stations, such as the communication partners involved or the type of connec- 
tion. The configured (logical) connections are listed in the connection table. 
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3 Device configuration 


A connection is defined unequivocally by means of the “local (connection) ID”. In 
the communication functions program, this local ID specifies the connection via 
which the data is to be transmitted. 


A connection is either dynamic or static depending on the communication service 
selected. Dynamic connections are not configured whose establishing and clearing 
down take place depending on events (“communication via non-configured con- 
nections”). Only one non-configured connection to a communication partner can 
exist at any time. 


Static connections are configured in the connection table; they are established 
during the startup and are retained throughout the complete program execution 
(“communication via configured connections”). Several connections can be estab- 
lished in parallel to one communication partner. Under “Connection type” in the 
network configuration you can select the desired communication service. 


Connection types 


Select the connection type depending on the subnet and the transmission protocol. 
In most cases this is the S7 connection. You can then exchange data between all S7 
devices on all subnets. The programming device also uses this connection type for 
programming the PLC and HMI stations. 


You use the other connection types, for example, if you wish to transmit data to 
third-party devices. This usually takes place by means of acommunication module. 
Various versions of the CP 443-1 communication module are available for commu- 
nication over Industrial Ethernet. In addition to an S7 connection, you can use the 
protocols for TCP connection, ISO transport connection, ISO-on-TCP connection, 
UDP connection, e-mail connection, and FTP connection. The CP 443-5 communica- 
tion module is available for the PROFIBUS subnet with which you can additionally 
exchange data via PROFIBUS FMS. A PtP (point-to-point) connection is created with 
the CP 441 communication module. 


You use the HMI connection for communication with an HMI station. 


Connection resources 


Every connection requires connection resources on the communication partners 
involved for the end point of the connection and for the transition point in a CP 
module. For example, one connection is occupied in the CPU if S7 functions are ex- 
ecuted over a bus interface of the CPU; the same functions over the bus interface of 
the CP module occupies one connection resource each in the CP module and in the 
CPU. 


Each CPU has a specific number of possible connections. Restrictions and rules 
apply to use of the connection resources. For example, not every connection 
resource can be used for every connection type. One connection is always reserved 
for a programming device, and another for an HMI station (these cannot be used for 
anything else). 


Temporary connection resources are also required for the “non-configured connec- 
tions” during S7 basic communication. 
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3.4 Configuring the network 


Configuring connections 


In order to configure a connection, click on the Connections button in the toolbar of 
the working window, and select the connection type in the adjacent list. The devices 
suitable for this connection type are then displayed highlighted in the Network view 
(Fig. 3.9). 


Click with the left mouse button on a station, drag the connection line with the 
mouse button pressed to the other station, and release the button. A connection 
with the connection name is displayed as a blue/white patterned line. Several logi- 
cal connections can be created using one cable. These connections are then also 
present in the connection table in the Connections tab in the bottom part of the 
working window. 


If you wish to determine which connections have been created in a subnet, click the 
Connections button and move the cursor to the subnet in the graphic display. If you 
click on one of the connections listed in the tooltip window, this connection is dis- 
played highlighted in the Network view. 
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Fig. 3.9 Representation of an HMI connection in the network configuration 
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3 Device configuration 


Connection properties 


Under General in the Properties tab, the inspector window shows the connection 
partners, the connection path, and the node addresses. If a station has several suit- 
able interfaces, you can select the appropriate one from a drop-down list. You can 
set further connection properties in the bottom part of the Properties window, e.g. 
which partner is responsible for active establishment of the connection, and the lo- 
cal connection ID. 


3.4.5 Configuring an MPI subnet 


To configure an MPI subnet, drag the MPI of one station to the MPI of the other sta- 
tion with the mouse. An MPI subnet will be created automatically. You can also drag 
an MPI to an existing MPI subnet. 


Setting the properties of an MPI subnet 


To set the properties, select the MPI subnet and then the Properties tab in the in- 
spector window. Under General you can assign a different name to the subnet and 
also change the subnet ID if appropriate. Under Network settings you set the high- 
est node address and the transmission speed in this subnet. You must observe the 
technical specifications of the involved modules when doing this. 


Setting the properties of an MPI interface 


To set the properties, select the MPI and then the Properties tab in the inspector 
window. Under General you can set a different name for the interface. Under MPI 
address you set the MPI address of the CPU (Fig. 3.10). 


The MPI address can be assigned as desired. It must not be higher than the highest 
node address for the MPI subnet set in the CPU properties during hardware config- 
uration. 


General 


> General 


Peeps MPI address 
Clock Interface networked with 
Diagnostics addresses 
Subnet: | MPI_1 ; ; [y] 
Parameters 
1 Interface type: | MPI |~) 
[ Address: |2 oa 


| 

| 

| 
Highest address: | 

il 


Transmission speed: 


Fig. 3.10 Example of the properties of an MPI 
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3.4 Configuring the network 


The MPI address 0 is reserved as standard for a programming device, which can be 
connected temporarily to the MPI subnet for servicing purposes. An operator sta- 
tion with MPI connection has the MPI address 1 as the factory setting, and a CPU 400 
has the MPI address 2. 


3.4.6 Configuring a PROFIBUS subnet 


To configure a PROFIBUS subnet, drag the DP interface of one station to the DP in- 
terface of the other station with the mouse. A PROFIBUS subnet will be created au- 
tomatically. You can also drag a DP interface to an existing PROFIBUS subnet. With 
a combined MPI/DP interface, first set PROFIBUS as the interface type in the 
interface properties. 


Setting the properties of a PROFIBUS subnet 


To set the properties, select the PROFIBUS subnet and then the Properties tab in the 
inspector window. Under General you can assign a different name to the subnet and 
also change the subnet ID if appropriate. Under Network settings you set the high- 
est node address, the transmission speed, and the profile in this subnet. You must 
observe the technical specifications of the involved modules when doing this (Fig. 
3.11). 


General 


General 


: Network settings 

Network settings 

Cable configuration 

Additional network devices Highest PROFIBUS address: | 126 lw 

SIE Transmission speed: | 1.5 Mbps I~ 

Profle: [DP aa 

Standard 
Universal (DP/FMS) 
User-defined 


Fig. 3.11 Example of network settings on the PROFIBUS 


The selectable bus profiles have the following properties: 


> The DP bus profile contains the optimized settings of the bus parameters for 
devices which comply with the requirements of the EN 50170 Volume 2/3, Part 8-2 
PROFIBUS standard, for example all SIMATIC S7 DP masters and DP slaves. 


> Compared to the DP bus profile, the Standard bus profile additionally contains 
the option for considering non-configured nodes during calculation of the bus 
parameters, for example nodes from other projects. 


> Select the Universal bus profile if the PROFIBUS FMS service is to be used in the 
PROFIBUS subnet. 
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3 Device configuration 


> When using the User-defined bus profile, you can set the parameters of the 
PROFIBUS subnet yourself in the subnet properties. Correct functioning is only 
guaranteed if the bus parameters are matched to one another. You should only 
change the default values if you are familiar with how to configure the bus pro- 
file for PROFIBUS. 


Setting the properties of a DP interface 


To set the properties, select the DP interface and then the Properties tab in the 
inspector window. Under General you can set a different name for the interface. 
Under PROFIBUS address you set the node address of the CPU. 


Every station on the PROFIBUS DP has a node address (station number) with which 
it can be addressed unequivocally on the bus. The addresses in a PROFIBUS subnet 
can be freely assigned in the range from 1 to 126. The node address 0 is reserved as 
standard for a programming device, which can be connected temporarily to the 
PROFIBUS subnet for servicing purposes. 


STEP 7 assigns node addresses from 2 upwards as standard in the hardware config- 
uration. It is recommendable to assign the addresses without gaps. 


Under Operating mode you set whether the module is to be operated as a DP master 
or DP slave. There is only one DP master in a DP master system. 


Under Clock you set the synchronization mode for the real-time clock. As master, 
the real-time clock synchronizes the clocks in other devices; as slave, the real-time 
clock is synchronized by a clock in another device. This setting is independent of 
the mode as DP master or DP slave. 


SYNC/FREEZE is a function for simultaneous output (SYNC) and/or reading-in 
(FREEZE) of the signal states of the DP slaves involved. Here you set which SYNC or 
FREEZE group the module is to belong to. Further details can be found in chapter 
16.4.5 “Special functions for PROFIBUS DP” on page 661. 


You can change the diagnostic address of the interface under Diagnostic addresses. 
Further information can be found in Chapter 16.4.2 “Addresses with PROFIBUS DP” 
on page 652. 


3.4.7 Configuring a PROFINET subnet 


To configure a PROFINET subnet, drag the PN interface of one station to the PN 
interface of the other station with the mouse. A PROFINET subnet will be created 
automatically. You can also drag a PN interface to an existing PROFINET subnet. 


Setting the properties of a PROFINET subnet 


To set the properties, select the PROFINET subnet and then the Properties tab in the 
inspector window. Under General you can assign a different name to the subnet and 
also change the subnet ID if appropriate. 
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3.4 Configuring the network 


Setting the properties of a PN interface 


To set the properties, select the PN interface and then the Properties tab in the 
inspector window. Under General you can set a different name for the interface. 
Under Ethernet addresses you set the IP address and the subnet mask of the CPU. 


Ethernet address (MAC address) 


The MAC (Media Access Control) address is an unambiguous address assigned to 
the device and defined by the manufacturer. It consists of three bytes with the 
manufacturer ID and three bytes with the device ID. The MAC address is usually 
printed on the device and is assigned to the latter during the configuration - if this 
has not already been carried out in the factory. The bytes are assigned in hexadeci- 
mal form (symbols 0 to F), whereby the individual bytes are separated by colons. 
Example: 01:23:45:67:89:AB. 


IP address and subnet mask 


Each station on the Industrial Ethernet subnet which uses the TCP/IP protocol re- 
quires an IP (Internet Protocol) address. The IP address must be unique on the sub- 
net. The IP address consists of four bytes, each separated by a dot. Each byte is rep- 
resented as a decimal number from 0 to 255. 


The IP address consists of the subnet address and the station address. The contri- 
bution made by the network address to the IP address is determined by the subnet 
mask. This consists — like the IP address - of four bytes which normally have a value 
of 255 or 0. Those bytes with a value of 255 in the subnet mask determine the sub- 
net address, those bytes with a value of 0 determine the node address (Fig. 3.12). 


Values other than 0 and 255 can also be assigned in a subnet mask, thereby dividing 
up the address volume even further. The bits with “1” must be occupied beginning 
from the left without gaps. 


The IP address is assigned one time for the IO controller when configuring with the 
hardware configuration for the nodes of a PROFINET IO system. Starting from this, 
the hardware configuration assigns the IP addresses to the IO devices in ascending 
order. 


IP address and subnet mask 


IP address 192 168 1 3 The subnet address is 
left-justified in the 
IP address and is 
generated by bit-by-bit 
Subnet mask 255 255 ) 0 ANDing of the IP address 
with the subnet mask. 
The bit positions of the 
Subnet address 192 168 0 0 subnet mask occupied 
by "1" must be positioned 
left-justified without 


Station address 0 (0) 1 3 gaps. 


Fig. 3.12 Example of the structure of an IP address 
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3 Device configuration 


Device name, device number 


Every IO controller and every IO device has a device name. The device name is made 
up as standard from the name of the CPU used, the interface number, and the name 
of the PROFINET IO system: <CPU>.<Interface>.<IO system>. You can change the 
name of the respective component in its properties. 


The interface number is only used if the CPU has more than one PN interface. The 
name of the IO system can be automatically appended to the device name, separat- 
ed by a dot. To do this, activate the Use name as expansion for PROFINET device name 
checkbox in the properties of the PROFINET IO system. 


If the names used do not correspond to the conventions of IEC 61158-6-10 (name 
components basically consisting of lower-case letters, numbers, and hyphens sep- 
arated by a dot), STEP 7 generates a so-called “converted” name which is then down- 
loaded to the device (see Fig. 3.13). 
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Ethernet addresses 


Ethernet addresses 
y Advanced options Interface networked with 
Interface options 

~ Real time settings Subnet: | PNIIE_1 
10 cycle 

> Port [X1 P1] 

> Port [X1 P2] 

Diagnostics addresses 


4) 


IP protocol 


WPaddress: | 192.168.0 .4 


PROFINET 


PROFINETdevice name _ | io device_1 
Converted name: | ioxsdevicexb1652a 


Device number: |1 7 


Fig. 3.13 Example of Ethernet addresses for an IO device 


As a supplement to the device name, the hardware configuration assigns a device 
number to each IO device which is independent of the IP address and which you can 
change. Using this device number (station number) you can address the IO device 
from the user program, e.g. as a current parameter on a system block. 


IP address of the router 


A router establishes the connection between two subnets. If the target of a device 
connection is in a different subnet, the IP address of the corresponding router must 
also be specified. The connections of the router belong to two different subnets, and 
the IP addresses must also be selected accordingly. 


84 


3.4 Configuring the network 


Setting the interface parameters 


If the parameters of the PROFINET interface have not already been set during the 
hardware configuration, they can be defined during the network configuration. 


Prerequisite: A project with two or more stations is open and the device configura- 
tion shows the stations in the Network view. 


Select the PROFINET interface, e.g. by clicking with the mouse in the graphic dis- 
play or on the corresponding line in the tabular device or network overview. 


In the Properties tab of the inspector window, select the Ethernet addresses 
section under General. 


If the subnet has not yet been created, click on the Add new subnet button to 
connect the interface to a subnet. 


Enter the IP address and the subnet mask. 


Enter whether an IP router is used, and then the router address if applicable. 


You can display the addresses of the interfaces using the Show address label symbol 
in the toolbar of the Network view. 


You set the Operating mode for a CPU with integral PN interface. In addition to op- 
eration as an IO controller, you can also activate operation as an IO device and de- 
termine from which device the interface is to be parameterized: from the assigned 
10 controller or from the IO device itself. 


Under Advanced options you can set, among others, the options for real-time mode. 
Refer to chapter 16.3.4 “Configuring PROFINET IO” on page 642 (Fig. 3.14) for how 
to configure a PROFINET IO system. 


You can change the diagnostic addresses of the interface under Diagnostic address- 
es. Further information can be found in Chapter 16.3.2 “Addresses with PROFINET 
10” on page 638. 
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Fig. 3.14 Example of the operating mode settings for an integral PN interface 
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3.4.8 Configuring a PtP subnet 


A point-to-point connection is established with the CP 440 and CP 441 communica- 
tion modules. The CP 441 communication module requires an IF 963 interface 
module which depends on the protocol. This interface module can be connected 
with a PtP subnet (Fig. 3.15). 


PLC_1 PLC_2 
CPU 412-2 PN CPU 416-3 PNIDP 


Fig. 3.15 Example of a PtP connection with CP 441 


To configure a PtP subnet, switch on the device view for the station, drag the CP 441 
module from the hardware catalog under PLC > SIMATIC S7-400 > Communications 
modules > [module] to the slot in the rack and then drag the IF 963 interface module 
(RS 232, TTY, or RS 422/485) selected under ... > Point-to-point > PtP interface to the 
slot on the module. In the module properties, set the protocol in the Protocol group 
properties group (ASCII, 3964 (R) or printer, for the CP 441-2 also RK 512, Modbus 
master, or Modbus slave), the data transmission rate, and additional protocol-spe- 
cific properties. 


In the device view, in the module properties under Point-to-point interface, you can 
also connect the interface with a PtP subnet right away. 


Setting the properties of a PtP subnet 


In the network view, you network the PtP interface by selecting the interface and se- 
lecting Add Subnet or Assign to new subnet from the shortcut menu. 


To set the subnet properties, select the PtP subnet and then the Properties tab in the 
inspector window. Under General you can set a different name for the subnet. 


Setting the properties of a PtP interface 


To set the interface properties in the network view, select the PtP interface and then 
the Properties tab in the inspector window. Under General you can set a different 
name for the interface. Under Point-to-point interface, select an existing subnet for 
networking or define a new one. Under Protocol, set the protocol used, the data 
transmission rate, and the protocol-specific properties. 


Adding a PtP connection 


In network view, activate the Connections button in the toolbar and select the con- 
nection type PtP connection from the drop-down list. The CPUs are highlighted. 
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You add a connection to an unknown device (i.e. unknown to the project), such as a 
printer, by selecting the CPU and dragging it to the PtP interface of the CP module 
and double-clicking on the interface. A PtP connection to an unknown partner is 
added. 


You can highlight the PtP connection display if, with the Connections button activat- 
ed, you hold the cursor over the PtP subnet and click the PtP connection in the High- 
light connection tooltip. 


Establishing a PtP connection between two stations 


In network view, activate the Connections button in the toolbar and select the con- 
nection type PtP connection from the drop-down list. The CPUs are highlighted. A 
CP 443 communication module with an IF 963 interface module of the same trans- 
mission type is available in both stations. 


Drag the highlighted CPU to the highlighted partner CPU and release the mouse 
button. A new PtP subnet and a PtP connection will be created. With a PtP connec- 
tion selected, you can set its properties in the inspector window. 


Configuring a PtP connection 


With the PtP connection selected, you can set its properties in the inspector window 
(Fig. 3.16). 


General 


General 
Local ID 


Special connection properties Connection 
Address details 


General 


Offline status: g 


Name: | PtP_Connection_4099 


Connection path 
Local Partner 
q 
r () 1:Local -> Partner () 2:Partner > Local @ 3:Local <> Partner 
, 
End point: |PLC_2 | PLC_1 
Interface: | CP 441-2, IF 963_2(ROIS! ¥| CP 441-2, IF 963_2(ROIS] | 
Protocol: {RK512 RK512 
Subnet: |PIP_3 | © [prs - 
Connection is selected forRK512 RK512 CPU : 
cPUno.: |1 iy | no.: 1 ¥ 


Fig. 3.16 Example of the properties of a PtP connection 
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If under Special connection properties the option One-sided is activated, the connec- 
tion partner is the server for this connection, which can neither actively send nor 
receive. If Set up active connection is activated, the connection is actively established 
by this station. If Send status messages is activated, the station transmits its status 
messages via this connection to the partner station, which - if it is an S7-300/400 
station — can receive it with the communication function USTATUS. 
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4 Tags, addressing, and data types 


4.1 Operands and tags 


4.1.1 Introduction, overview 


In order to control a machine or process, signal states and numerical values are 
processed. Inputs are scanned, and their signal states linked together in accordance 
with the control task; the results then control the outputs. It is similar with the nu- 
merical values; these are selected, calculated, compared, and saved. The PLC station 
provides the following memory areas for these variable values (Fig. 4.1): 


Operand areas in a CPU 400 


Input 
modules 


Peripheral 
inputs =p 


System and work memory 


Process Process 
input image output image 
Bit memor SMMC 

¥ timer functions 
Temporary SIMATIC 
local data counter functions 


Output 
modules 


=p Peripheral 
outputs 


Global data blocks 
with freely-configured 
data structure 


Load and work memory 


Type data blocks 
with the data structure 
of a PLC data type 


Instance data blocks 
with FB parameters and 
static local data 


Fig. 4.1 Operand areas in a PLC station 


> Peripheral inputs are the memory areas on the input modules. They constitute 
the direct interface to the controlled machine or plant, e.g. in order to scan the 
settings of control elements or sensors. 


> Inputs are an image of the peripheral inputs in the CPU's work memory. These are 
normally processed by the user program if signal states of the machine or plant 
are to be scanned and linked. The totality of the inputs is the process image input. 


> Peripheral outputs are the memory areas on the output modules. They constitute 
the direct interface to the controlled machine, e.g. in order to control displays, 


valves, or contactors. 
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> Outputs are an image of the peripheral outputs in the CPU's work memory. These 
are normally processed by the user program if the results of the control func- 
tions are to be output. The totality of the outputs is the process image output. 


> Bit memories are a memory area in the CPU's system memory and are used asa 
global intermediate memory for signal states and numerical values. 


> Data refers to memory areas in the user memory. Data is organized in data 
blocks, which can either be addressed globally from all parts of the user program 
or which locally manage the data of a function block. They are then called static 
local data. 


> Temporary local data refers to memory areas assigned by the CPU to a code block 
during processing. The program can temporarily store signal states and numer- 
ical values in the block; these lose their validity when processing of the block has 
been completed. 


> The SIMATIC timer and counter functions save their data - contrary to the IEC 
timer and -counter functions - at a fixed position in the system memory. There- 
fore the SIMATIC timer and counter functions have a fixed number range, and 
their number depends on the memory space provided by a CPU for this purpose. 
You can find a description of these functions in Chapters 12.3 “SIMATIC timer 
functions” on page 477 and 12.5 “SIMATIC counter functions” on page 495. 


Access to the signal states and numerical values (the addressing) can be absolute or 
symbolic. Absolute addressing uses operands such as %I2.5, for example, which 
comprise the operand ID (lin this case) and the memory address (byte 2 bit 5 in this 
case). If a name and a data type are assigned to an operand (symbolic addressing), 
this is known as a tag. For example, the operand %I2.5 could have the name “Switch 
on machine” and the data type BOOL. 


The data type of an operand or tag defines which values the individual bits of the 
operand or tag have. An individual bit has the data type BOOL, and one refers to a 
binary operand or binary tag. Operands and tags with a data width of one byte 
(8 bits), one word (16 bits), or one doubleword (32 bits) are referred to as digital 
operands or digital tags. The data types for digital tags are extremely diverse. For 
example, the data type INT (integer) refers to a 16-bit wide fixed-point number, the 
data type CHAR to a character in ASCII code, and the data type ARRAY to a combina- 
tion of several tags with the same type of data under one tag name. 


4.1.2 Operand areas: inputs and outputs 


The peripheral inputs are the operands on the input modules. They contain the sig- 
nal states delivered by the machine or process to the programmable controller via 
the wiring. These signal states are automatically copied by the CPU's system pro- 
gram into the process image input prior to each processing cycle of the user pro- 
gram (see Chapter 5.5.2 “Process image” on page 177). 


The process image input for a CPU 400 is in the work memory. It contains the oper- 
and area Inputs. The inputs are used to scan binary signals in the user program and 
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to link their signal states. This means that the input modules are not directly 
scanned in the normal case, it is the process image input which is scanned. 


Access to the peripheral inputs is read-only. Inputs can be read and written. Inputs 
not occupied by peripheral inputs can be used as additional intermediate memories 
like the bit memories. 


The peripheral outputs are the operands on the output modules. They contain the 
signal states with which the machine or process is controlled via the wiring. The 
CPU's system program automatically transfers the signal states of the process im- 
age output to the peripheral outputs prior to each processing cycle of the user pro- 
gram (see Section 5.5.2 “Process image” on page 177). 


The process image output for a CPU 400 is in the work memory. It contains the op- 
erand area Outputs. The outputs are used to save the results of the control functions 
in the user program and to output these to the machine. This means that the output 
modules are not directly written in the normal case, it is the process image output 
which is written. 


Outputs can be read and written. Outputs not occupied by peripheral outputs can 
be used as additional intermediate memories like the bit memories. 


Access to the peripheral outputs is write-only. Writing of the peripheral outputs is 
automatically tracked by the process image output, and therefore there is no differ- 
ence in the signal states of the outputs and the peripheral outputs with the same 
address. 


User data area 


With SIMATIC S7, every module can have two address areas: a user data area which 
can be directly addressed by loading and transferring, and a system data area for 
the transfer of data records. 


When the modules are addressed it is irrelevant whether they are located in central 
racks or are used as distributed I/O. All modules are arranged equally in the (logi- 
cal) address volume. 


The user data properties of a module depend on the module type. These are digital 
or analog I/O signals for signal modules or, for example, control and status infor- 
mation for function and communication modules. The amount of user data is mod- 
ule-specific. There are modules which occupy one, two, four, or more bytes in this 
area. Occupation always commences at the relative byte 0. The address of the rela- 
tive byte 0 is the module start address, which is defined by the hardware configura- 
tion. 


The user data represents the peripheral operand area, divided into peripheral 
inputs and peripheral outputs depending on the transfer direction. If the user data 
is present in the area of the process images, the CPU automatically takes over data 
exchange when updating the process images. 
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Consistent user data areas 


Data consistency means that data is handled together. Transfer of the data block 
must not be interrupted, and the data source and destination must not be changed 
during the transfer either. For example, if you transfer four bytes individually, the 
transfer program can be interrupted between each byte by a program of higher pri- 
ority with the facility for changing the data in the source or destination area. 


With a direct access to user data (loading and transferring), the data is read and 
written as byte, word, or doubleword. The load and transfer statements which are 
also taken as the basis for the MOVE box with LAD/FBD and for the assignment of 
tags with elementary data types with SCL cannot be interrupted during execution. 
If you wish to transfer a data block with more than four bytes without interruption, 
use the system function UBLKMOV. 


The data transfer for PROFINET IO between IO controller and IO device is consistent 
for up to 1024 bytes; for PROFIBUS DP between DP slave and DP master, it is 32 
bytes. This applies regardless of the distribution of the user data interface into sev- 
eral consistent transfer areas for I-slaves or I-devices. The data consistency with di- 
rect data exchange is as with direct access (1, 2 and 4-byte consistency). 


You can specify consistent user data areas when configuring stations of the distrib- 
uted I/O with three bytes or more than four bytes of user data. You then transfer 
these areas consistently to the parameterized destination area, for example a data 
area in the work memory, using the system blocks DPRD_DAT and DPWR_DAT. 


Note that the “normal” updating of process images can be interrupted following 
each transmitted doubleword. An exception is the transfer of user data blocks con- 
figured as consistent for distributed I/O with the system blocks UPDAT_PI and UP- 
DAT_PO, which generally transfer a process image (partition), and SYNC_PI and 
SYNC_PO, which transfer a process image partition on synchronous cycle interrupt. 


CPU-specific values apply to the maximum size of a consistency area for data trans- 
fer with S7 basic communication and S7 communication by the operating system. 


Diagnostic and parameter data is always transferred consistent in data records, for 
example diagnostic data with the system block RALRM or parameter data trans- 
ferred to and from modules with the system blocks RDREC and WRREC. 


4.1.3. Operand area: bit memory 


The bit memories are, as it were, the “auxiliary contactors” of the controller. They 
mainly serve to save binary signal states. They can be treated like outputs, but are 
not connected “to the outside”. The bit memories are located in the system memory 
of a CPU 400; they are thus always available. 


The bit memories are used if intermediate results are to be valid beyond block lim- 
its and are to be processed in several blocks. 


Bit memories can be read and written without limitation. 
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Retentive bit memories 


Some of the bit memories can be set “retentive”, i.e. this part retains its signal state 
even when deenergized. Retentivity always starts at memory byte 0 and ends at the 
set upper limit. You can set the retentivity when assigning the CPU parameters. 


Clock memories 


Many processes in the controller re- Assignment of clock memory byte 


quire a periodic signal. This can be 


implemented using timer functions Clock memory byte 

(clock generator), cyclic interrupts 7\6) 5) 41 3) 2) 1) 0 
(time-based program execution), or | 

in a particularly simple manner with 10 Hz 

clock memories. 5 Hz (flickering light) 


2.5 Hz (fast flashing light) 
2 Hz 
1.25 Hz (flashing light) 
Hz 
0.625 Hz (slow flashing light) 
0.5 Hz 


Clock memories are memories whose 
signal state changes periodically with 
a pulse-to-pause ratio of 1:1. The 
clock memories are combined in one 
byte whose individual bits corre- 
spond to fixed frequencies (Fig. 4.2). 
You define the number of the clock _ Fig. 4.2 Assignment of clock memory byte 
memory byte when assigning the CPU 

parameters. The clock memories are 

also updated in the startup program. Note that the clock memories are updated 
asynchronous to processing of the main program. 


Please note that the clock memory byte must not be overwritten by the user program 
since this could result in incorrect responses in the user program and operating 
system. 


4.1.4 Operand area: data 


The operand area Data is organized in data blocks which are present in the user 
memory. Data blocks are available in three versions: 


> Global data blocks have a data structure which is defined when configuring the 
data block. 


> Type data blocks are derived from PLC data types. The data structure of a type 
data block is based on a PLC data type. 


> Instance data blocks are derived from function blocks. The data structure of an 
instance data block is defined in the function block. An instance data block con- 
tains the values of the block parameters and static local data for calling the func- 
tion block, for an “instance”. The instance data is local data for the program in 
the function block. 


Data blocks are global objects which can be addressed in absolute mode using their 
number, or symbolically using a name. The name of a data block must be unique 
on the CPU. The data operands within a data block are local data. The name of a data 
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operand must be unique in the data block. In association with the data block, a data 
operand has the character of a global tag. 


Data tags of every data block can be read and written without restrictions — indepen- 
dent of the version as global, type or instance data block - unless the Data block 
write-protected in device attribute has been activated for the data block. 


The data present in data blocks can be retentive, i.e. it retains its value even when 
deenergized. With a CPU 400, only a complete data block can be either retentive or 
non-retentive. 


4.1.5 Operand area temporary local data 


Temporary local data are operands present in the local data stack (L stack) of the 
CPU. Each logic block can use temporary local data for intermediate storage. Tem- 
porary local data is only available during block processing, and its contents are lost 
when the block is left. 


The tags in the operand area “temporary local data” are declared in the block inter- 
face (see Chapter 5.2.5 “Block interface” on page 162). 


For block processing, the operating system of a CPU 400 makes a CPU-specific max- 
imum amount of temporary local data available per execution level, i.e. per organi- 
zation block with all blocks called within. 


Table 4.1 shows the available amount of temporary local data of a CPU 400 and the 
standard assignment for each priority class, i.e. for each execution level or each or- 
ganization block assigned to the priority class. The total available range can be di- 
vided among the priority classes in use according to your needs. The minimum 
amount is 20 bytes. If you assign a priority class zero bytes, the priority class is de- 
selected. Each organization block assigned to this priority class is then deactivated 
and cannot be started, even if it is available in the user memory. 


You should use the actual memory requirements as a guide for the amount of as- 
signed local data. The less memory you set for the temporary local data, the more 
room is available for the data blocks in the work memory. 


The amount of temporary local data required by a block which has already been 
compiled can be seen in the call structure of the user program. With the project 
open, select the Program blocks folder in the project tree, and then select the Call 
structure command from the shortcut menu. The occupied temporary local data is 
displayed in the call path and per block in the table which is then output. 


Table 4.1 Memory sizes for temporary local data in bytes 


CPU type CPU 412 CPU 414 CPU 416 CPU 417 
Maximum size 8192 16 384 32 768 65 526 
Default maximum size 4096 8192 16 384 32 768 
Default setting per priority class 256 256/758 256/1024 1024 


94 


4.2 Addressing of operands and tags 


Use of temporary local data 


In order to use temporary local data for meaningful purposes, it must be written 
before being read. Within the block, the temporary local data can be read and writ- 
ten without limitations. 


The temporary local data is addressed symbolically as standard. Absolute address- 
ing of temporary local data is only possible in the programming languages STL, 
LAD, and FBD via operand area L. 


All elementary, complex and PLC data types are permissible for the tags in the tem- 
porary local data. 


All operations which also apply to the bit memories are permissible for the tempo- 
rary local data. However, please note that a temporary local data bit is not suitable 
as an edge trigger flag since it does not retain its signal state beyond block process- 
ing. 


The organization blocks pass on start information in the temporary local data. The 
general data structure of the start information is described in Chapter 4.8 “Start in- 
formation” on page 141, the special characteristics along with the individual 
organization blocks. 


A tag in the temporary local data can be declared - as an exception — with the data 
type ANY. You can then generate an ANY pointer using STL which can be changed 
during runtime (for more details, see Chapter 4.6.3 ““Variable” ANY pointer with 
STL” on page 138). Using SCL you can assign the address of another (complex) 
tag to atemporary ANY tag during runtime (for more details, see Chapter 4.6.4 
“Variable” ANY pointer with SCL” on page 138). 


4.2 Addressing of operands and tags 


4.2.1 Signal path 


By wiring the machine or plant you define which signals are connected to the PLC 
station, and where (Fig. 4.3). 


An input signal, e.g. the signal from pushbutton +HP01-S10 with the significance 
“Switch on motor”, is connected to a specific terminal on an input module. You con- 
figure the slot in which the module is inserted in the hardware configuration using 
STEP 7. You also use the hardware configuration to set the module start address with 
which the signals are addressed by the module in the user program. This setting is 
simultaneously the address in the process image. 


The CPU automatically copies the signal from the input module into the process 
image input every time before program execution is started, where it is then 
addressed as the operand “Input” (e.g. %I 5.2). The expression “%I 5.2” is the absolute 
address. 
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Signal path from sensor to process image 


Input module System memory 
Input Peripheral Process 
terminals inputs input image 
+HPO01 ©] | Relative 0 | Byte 4 Bit 
-$10 2| | byteo 76543210 
@ 
5 Byte 4 
a Byte 5 
@|7 
o10 Relative 0 | (Byte 5) A 
e byte 1 I 
oe} -_- ae __ __B eager! 
@ 
e 
e@ 
e 
e117 7 
Slot Module start Absolute 
address address addressing 
The slot address identifies a The module start address The address in the process 
specific module in the station. identifies the module in the image is derived from the 
It contains the numbers of the "logical" address area of the module start address. In the 
rack and slot. station. It represents the example, the absolute address 
lowest byte of the module. of the input signal is: %I5.2. 


Fig. 4.3 Signal path from sensor to process image 


You can now give this input a name in that you assign a name corresponding to the 
significance of this input signal (e.g. “Switch on motor”) to the absolute address in 
the PLC tag table. The expression “Switch on motor” is the symbolic address. 


The same applies analogously to the output signals. In the hardware configuration 
you define the slot for the output module and also the module start address. This is 
then also the address in the process image output. You can also assign a name to this 
address in the PLC tag table. 


4.2.2 Absolute addressing of tags 


The absolute address of a signal state or numerical value consists of the specifica- 
tion of the operand area and operand width supplemented by a number which 
defines the position within the operand area. Examples are: 

%12.5 Bit 5 in byte 2 in the operand area “Inputs”. 

%QB34 Byte 34 (8 bits) in the operand area “Outputs”. 

%IW128:P Word 128 (16 bits) in the operand area “Peripheral inputs”. 

%MD200 Doubleword 200 (32 bits) in the operand area “Bit memory”. 


An absolute address is identified via a preceding percent sign (%). 


The bits in a byte are counted from right to left, starting with zero. Counting is start- 
ed from the beginning for each byte. Each operand area is organized in bytes. The 
bytes are counted commencing at the start of the area with zero. With an operand 
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Absolute bit and byte addressing 


%Md24 
Bitnumber [76543210 ee 
Byte number 24 25 26 7 
%MB24 *6M25.1 %%MB26 %)M27.7 
was 


Fig. 4.4 Example of bit and byte assignments 


of byte width, the number of the byte is specified as the byte address; with an oper- 
and of word width, the number of the least significant byte; and with an operand of 
doubleword width, the least significant byte number in the doubleword. Fig. 4.4 
clarifies this using an example of memory bytes %MB24 to %MB27. 


Absolute addressing of inputs, outputs, and bit memories 


The addresses of the peripheral inputs and outputs (the input and output channels 
on the modules) are defined during configuration of the station design using the 
hardware configuration. The assigned inputs and outputs in the process image 
have the same addresses. To identify the peripheral addresses, “:P” is appended to 
the input or output address (Table 4.2). 


Table 4.2 Absolute addressing of inputs, outputs, and bit memories 


Operand area Operand ID Bit Byte Word Doubleword 
(1 bit) (8 bits) (16 bits) (32 bits) 

Input | %ly.x %IBy %IWy %IDy 

Peripheral input I:P = %IBy:P %lWy:P %IDy:P 

Output Q %Qy.x %QBy %QWy %QDy 

Peripheral output Q:P = %QBy:P %QWy:P %QDy:P 

Bit memory M %My.x %MBy %MWy %MDy 


y = byte address; x = bit address 


A peripheral address is only considered to be present if the correspondingly 
addressed module is also present. Access to a non-existent peripheral address trig- 
gers an error. The operand areas “Inputs, outputs, and bit memories” are present in 
the complete, CPU-specific length. Therefore inputs and outputs which are not 
assigned to a module can also be addressed. In this case they behave like bit mem- 
ories. 
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Complete addressing of data operands 


Data operands are combined into data blocks in the user memory. A data operand 
is a local tag within a data block. If addressing of the data operand is carried out in 
conjunction with the data block, the data operand is unique on the CPU, in other 
words it is a global tag. 


In the case of this “complete” addressing, the data block precedes the data operand. 
For example, %DB10.DBW4 addresses data word 4 in data block 10. The data oper- 
and itself can be addressed with a width of bit, byte, word or doubleword (Table 4.3). 


Table 4.3 Absolute complete addressing of data operands 


Operand Operand ID Bit Byte Word Doubleword 
area (1 bit) (8 bits) (16 bits) (32 bits) 
Data DB %DBz.DBXy.x | %DBz.DBBy %DBz.DBWy %DBz.DBDy 


z = data block number, y = byte address, x = bit address 


The numbering of the data blocks commences at 1 and ends at a CPU-specific upper 
limit. Data block DB 0 does not exist. A data block can have a size of up to 64 KB. 


The absolute address of a data operand is shown in the Offset column of the block 
interface once the data block has been compiled. 


Partial addressing of data operands 


Partial addressing of data operands is possible in the programming languages LAD, 
FBD, and STL. 


“Partial addressing” means that data operands are addressed individually. To do 
this, itis important that the “correct” data block has been opened in advance. A data 
block is opened using a data block register, of which there are two types: The global 
data block register (abbreviated to DB register) and the instance data block register 
(DI register). Accordingly, there are also two statements: Opening via the DB regis- 
ter and opening via the DI register (see Chapter 14.5.1 “Opening a data block” on 
page 583). 


Table 4.4 Operand IDs with partially addressed data operands 


Operand area ID Bit Byte Word Doubleword 
(1 bit) (8 bits) (16 bits) (32 bits) 
Data partially addressed DB DBXy.x DBBy DBWy DBDy 


via the DB register 


Data partially addressed DI DIXy.x DIBy DIWy DIDy 
via the DI register 


x = bit address, y = byte address 
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Therefore two data blocks may be open simultaneously. The addressed data block 
is defined by various data operands: A data operand with the operand ID “DB” is 
present in a data block opened via the DB register, a data operand with the oper- 
and ID “DI” in a data block opened via the DI register (Table 4.4). 


The absolute address of a data operand is shown in the Offset column of the block 
interface once the data block has been compiled. 


Restrictions in partial addressing of data operands 


Complete addressing should be preferred for the absolute addressing of data operands. 
Partial addressing is only considered for special applications since, in order to use 
partial addressing error-free, it is necessary to know how the program editor com- 
piles the user program into machine code. In the following cases the program editor 
generates additional statements which change the contents of the data block register 
- but not visible for you in the user program of the respective programming lan- 
guage: 


> Complete addressing of data operands 


With each complete addressing of data operands, the program editor first opens 
the data block and then accesses the data operands. The DB register is overwrit- 
ten in each case. This also applies to the writing of block parameters with com- 
pletely addressed data operands. 


> Access to block parameters 


Access to the following block parameters changes the content of the DB register: 
With functions (FC), all block parameters with complex data type, and with func- 
tion blocks (FB), in-out parameters with complex data type. 


> Calls of function blocks and system function blocks 


The CALL statement or the call box saves the number of the current instance data 
block in the DB register prior to the actual block call (by swapping the data block 
registers) and opens the instance data block for the called function block. As a 
result, the associated instance data block is always open in a called function 
block. Following the actual block call, the CALL statement or the call box again 
swaps the data block registers so that the current instance data block is again 
available in the calling function block. The CALL statement or the call box thus 
changes the content of the DB register. 


> DIregister in function blocks 


In function blocks, the DI register always has the number of the current instance 
data block. All access operations to block parameters or static local data are car- 
ried out via the DI register and, as a side note, also via the address register AR2 
for function blocks with “multi-instance capability”. If you change the content of 
the DI or AR2 register (possible with STL), all subsequent access operations to 
block parameters and static local data are carried out incorrectly. Every change 
to these registers must be reversed before block parameters or static local data 
are accessed. 
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Absolute addressing of static local data 


The static local data - just like the block parameters - are local tags in a function 
block. Local tags are usually addressed symbolically. 


The programming language STL makes it possible to use indirect addressing to 
address static local data operands in absolute mode. For more details, refer to 
Chapter 4.3.3 “Working with the address registers with STL” on page 108. 


The values of the block parameters and the static local data of a function block are 
present in a data block, and therefore these tags can be addressed by each code 
block using “Data block”.Data operand just like with “normal” data tags. 


Absolute addressing of temporary local data 


The temporary local data are local tags in a code block. Local tags are usually 
addressed symbolically. 


Absolute addressing is also possible with the programming languages LAD, FBD, 
and STL. The operand ID is L (Table 4.5). The absolute address of a temporary local 
data operand is shown in the Offset column of the block interface once the code 
block has been compiled. 


Table 4.5 Absolute addressing of temporary local data 


Operand area | Operand ID Bit Byte Word Doubleword 
(1 bit) (8 bits) (16 bits) (32 bits) 

Temporary L %Ly.x %LBy %LWy %LDy 

local data 


y = byte address; x = bit address 


Absolute addressing of SIMATIC timer and counter functions 


The SIMATIC timer and counter functions present in the system memory are 
addressed by a number starting at 0. The upper limit of the numbering - according 
to the maximum number of timer and counter functions — is CPU-specific. The tim- 
er and counter functions can be selected as desired within the quantity framework. 
Example of absolute addressing: %T15. Table 4.6 shows the operand IDs of these 
functions. 


Table 4.6 Absolute addressing of SIMATIC timer and counter functions 


Operand area Operand ID Address 
SIMATIC timer function iT: n 
SIMATIC counter function Cc n 

n= number 


100 


4.2 Addressing of operands and tags 


4.2.3 Symbolic addressing of tags 


During symbolic addressing, an operand is assigned a name and a data type. This 
is called a tag. For example, the operand %I2.5 could have the name “Switch on 
machine” and the data type BOOL. The tag “Switch on machine” can then be used in 
the program instead of the operand %I2.5. 


Letters, digits, and special characters - except double quotes - are permissible as 
tag names. No distinction is made between upper and lower case when checking the 
name. 


Symbolic addressing of global tags 


Global tags can be addressed by any block in the entire program. They are declared 
in the PLC tag table, and have a unique name within the user program. Global tags 
are located in the following operand areas: inputs, peripheral inputs, outputs, 
peripheral outputs, bit memories, SIMATIC timer functions, and SIMATIC counter 
functions. 


Global tags must not have a name which has already been assigned to a constant, 
PLC data type or block. The program editor indicates the name of a global tag in 
quotation marks. 


Symbolic addressing of block-local tags 


Block-local tags are declared within a block in its interface definition. They have a 
unique name within the block. The same tag name can be used in another block 
with another meaning. 


The operand areas of the block-local tags are 

> the temporary local data in the L stack for all code blocks, 

> the block parameters for functions (FC) and function blocks (FB), 

> the static local data in the instance data block for function blocks (FB), and 
> the data operands for data blocks (DB). 


The program editor indicates the name of a block-local tag with a preceding num- 
ber character (#). If the name includes special characters, it is additionally indicated 
in quotation marks. 


Symbolic addressing of data tags 


Symbolic addressing of data tags is carried out during complete addressing. 
Symbolic partial addressing is not possible. Example: In the tag named “Mo- 
tor_1”.Switch on motor, Motor_1 is the name of the data block and Switch on motor 
the name of the data operand. 


Partial addressing of the data block and data operand can be entered independent 
of each other either absolute or symbolic. However, the program editor indicates 
the complete address - depending on the setting — either as absolute and/or sym- 
bolic address. 
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4.2.4 Addressing constants 


A “constant” is a fixed numerical value. When programming a constant, you must 
observe the correct notation depending on the constant's data type (Table 4.7). 


Table 4.7 Notation for constant values 


Data type Length Description Examples of representation 
BOOL 1 bit Bit value FALSE, TRUE, 16#0, 16#1 
BYTE 8 bits Bit string with 8 bits BH#16#0, BH16#FF 
CHAR 8 bits Character in ASCII code | ‘a’, ’Z’ 
WORD 16 bits Bit string with 16 bits W#16#0000, W#16#FFFF 
DWORD 32 bits Bit string with 32 bits DW#16#0000_0000, DW#16#FFFF_FFFF 
NT 16 bits 16-bit fixed-point —32_768, 0, +32_767 
number 
DINT 32 bits 32-bit fixed-point -2_147_483 648, 0, +2_147_483 647 
number 
REAL 32 bits 32-bit floating-point Exponential representation: +1.234567E+02 ” 
number Decimal representation: —123.4567 ” 
S5TIME 16 bits Time value for S5T#10ms, SSTIME#2h46m30s 
SIMATIC times 
TIME 32 bits Time value in IEC T#-24d20h31m23s647ms, T#Oms, 
format TIME#24d20h31m23s647ms 
DATE 16 bits Date D#1990-01-01, DATE#2168-12-31 
TIME_OF_DAY 32 bits Time of day TOD#00:00:00.000, TIME_OF_- 
DAY#23:59:59.999 
DATE_AND_TIME 64 bits Date and time DT#1990-01-01-00:00:00.000, 
DATE_AND_TIME#2168-12-31-23:59:59.999 
STRING Variable Character string ‘ABCD’, ‘012345’ 


’) For range of values, see Chapter 4.4.5 “Floating-point data type REAL” on page 124 


Symbolic addressing of constants 


Globally valid constants can be assigned a name in the PLC tag table in the User con- 
stants tab. Letters, digits, and special characters — except double quotes - are per- 
missible for the name. All elementary data types are permissible. 


The name of a constant is unique on the CPU. A name with which a PLC tag, PLC data 
type, or block has already been identified cannot be assigned to a constant. No dis- 
tinction is made between upper and lower case when checking the name. 
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4.3 Indirect addressing 


Indirect addressing allows you to address operands whose address is only defined 
during runtime. You can also use indirect addressing to repeatedly execute pro- 
gram sections, e.g. in a loop, and use different operands in each cycle. 


The statements required for indirect addressing are present in the programming 
languages STL and SCL, but not in LAD and FBD. 


Since with indirect addressing the addresses are only calculated during runtime, 
the danger exists that memory areas can be overwritten unintentionally. The auto- 
mation system could then react in an unexpected manner! Therefore be extremely 
careful when using indirect addressing! 


Overview of types of addressing with STL and SCL 


STL and SCL use different methods for indirect addressing. STL distinguishes 
between memory-indirect and register-indirect addressing: 


> Memory-indirect addressing, 
example: IW [%MD200], the number of the input word is present in the 
bit memory doubleword %MD200. 


> Register-indirect, area-internal addressing, 
example: IW [AR1, P#2.0], the number of the input word is present in the 
address register AR1; it is incremented by the offset P#2.0 when the opera- 
tion is executed. 


> Register-indirect, area-crossing addressing, 
example: W [AR1, P#0.0], the operand area and the number of the operand 
are present in the address register AR 1; the number is not incremented 
when the operation is executed. 


Memory-indirect addressing uses doublewords from the operand areas “Data” 
(DBD and DID), “Bit memories” (MD), and “Temporary local data” (LD) as “address 
registers”. These operands can be addressed absolutely or symbolically. With sym- 
bolic addressing, the data types must have the required width of 16 bits or 32 bits. 


Register-indirect addressing uses the two address registers AR1 and AR2. 


STL allows determination of the absolute address of a symbolically addressed local 
tag during runtime and to then change this address if applicable. The required pro- 
cedure is described in Chapter 4.3.4 “Direct access to complex local tags with STL” 
on page 115. 


SCL allows indirect addressing of operands and arrays: 


> With indirect addressing of operands, SCL considers an operand area like an 
array whose elements can be addressed individually. 
Example: MW(#index), the number of the bit memory word is present in the 
#index tag. 
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> In the case of a variable with the data type ARRAY, SCL permits a variable as in- 
dex. Example: #Array[#index], the number of the array element is present in the 
#index variable. 


The index tags can be global or local tags addressed absolutely or symbolically. 
With symbolic addressing, the index tags must be of data type INT. 


4.3.1 Memory-indirect addressing with STL 


“Address register” for memory-indirect addressing 


Indirect memory addressing uses an operand from the operand areas 
“Bit memories” (M), “Temporary local data” (LD) or “Data” (DB and DI) as “address 
registers”. A word or doubleword is required depending on the operands to be 
addressed (see below). 


A bit memory word or a bit memory doubleword can be used generously as an 
“address register” in the user program since the bit memories are global tags. 


You can use a word or doubleword from the temporary local data if the content of 
the word or doubleword is not used beyond execution in the block. 


Use of a data operand as address register is partial addressing. The data operand is 
only “valid” for as long as the associated (“correct”) data block is open. Associated 
with this are all disadvantages of partial addressing of data operands, since the pro- 
gram editor also uses the data block registers DB and DI, which is not visible on the 
programming interface. Refer to section “Partial addressing of data operands” on 
page 98 for information on what you must observe. 


Indirectly addressable operands 


The memory-indirect addressable operands can be divided into two categories: Op- 
erands which can have a bit address, and operands which never have a bit address. 


Operands which can have a bit address are located in the following operand areas: 
inputs (I), outputs (Q), peripheral inputs and outputs (I:P and Q:P), data (DB and 
DI), and temporary local data (L). These operands require an area pointer as 
address which contains the bit and byte address - even if the operand to be 
addressed is of word width, for example, and has no bit address. The structure of 
this area-internal pointer is described in Chapter 4.6.2 “Pointer” on page 135. Refer 
to section “Partial addressing of data operands” on page 98 for information on what 
you must observe when addressing data operands. 


Memory-indirect addressable operands which never have a bit address are SIMATIC 
timer functions (T), SIMATIC counter functions (C), data blocks (DB), functions 
(FC), and function blocks (FB). With indirect addressing of these operands, an op- 
erand of word width containing a number as the address is sufficient as the “ad- 
dress register”. 
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Examples of memory-indirect addressing with an area pointer 


P#128.0 


"Pointer" 


IW["Pointer™] 


"Pointer" 
2 
3 


POs Gea 


QW["Pointer"] 


P#54.2 


Me @yakioeeie 


iL || Mioariniesse” |] 


PPOnsniee iat 
a 


eXeyaLigniersiell 


M["Pointer"™] 


The address register “Pointer” is loaded with byte address 
128. The bit address is 0. 


The statement L %IW128 is executed. 


The byte address is incremented by 2 in the address regis- 
ter. Since the bit address is in the bottom 3 bits, the value 
is shifted by 3 to the left. One can also immediately add a 
value multiplied by 8 - in this case 16 — to the address reg- 
ister. 


The statement T %QW130 is executed. 


The address register “Pointer” is loaded with byte address 
54 and bit address 2. 


The statement A %154.2 is executed. 


The bit address is incremented by 1 in the address register 


The statement = %M54.3 is executed. 


Examples of memory-indirect addressing with a number 


CU 


+D 


108 


"Number" 


C["Number"] 


"Number" 
10 


"Number" 


T["Number"] 


DB["Number"] 
DI["Number"] 


FC["Number"] 
FB["Number"] 


The address register “Number” is loaded with the value 
108 


The statement CU %C108 is executed. 


The value is incremented by 10 in the address register. 


The statement R %T118 is executed. 


The statements OPN %DB118 and OPN %DI118 are exe- 
cuted. 


The statements UC %FC118 and CC %FB118 are executed. 


Fig. 4.5 Examples of memory-indirect addressing with STL 
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Memory-indirect addressing with an area pointer 


The area pointer required for memory-indirect addressing is always an area-inter- 
nal pointer, i.e. it always consists of byte and bit address. You must specify 0 as the 
bit address when addressing a digital operand. 


You can use the memory-indirect addressing with area pointer for all binary oper- 
ands in conjunction with the binary logic operations and memory functions, and 
for all digital operands in conjunction with the load and transfer functions. The up- 
per example in Fig. 4.5 uses the “Pointer” tag as address register. The tag could be, 
for example, the bit memory doubleword %MD200 with the data type DINT. 


Memory-indirect addressing with a number 


The number required for memory-indirect addressing is an unsigned 16-bit fixed- 
point number. Memory-indirect addressing with a number can be applied in con- 
junction with SIMATIC timer and counter functions and with the block types DB, FC, 
and FB. 


You can open a data block via the DB register (OPN [..]) or via the DI register (OPNDI 
[..]). If there is zero in the address word, the CPU performs an NOP operation and 
the current data block is no longer opened. A subsequent partially addressed access 
- e.g. with L %DBBO — generates an addressing error. 


You can indirectly address the call of code blocks with UC FC [..] and CC FC [..] or 
UC FB [..] and CC FB [..]. The call with UC or CC is simply a change to another block; 
a transfer of block parameters or the opening of an instance data block does not 
take place. 


The lower example in Fig. 4.5 uses the “Number” tag as address register. The tag 
could be, for example, the bit memory word %MW204 with the data type INT. 


4.3.2 Register-indirect addressing with STL 


Register-indirect addressing uses one of the address registers AR1 or AR2 in order 
to determine the address of the operand. Operations used in conjunction with reg- 
ister-indirect addressing are located in the following operand areas: inputs (I), out- 
puts (Q), peripheral inputs and outputs (I:P and Q:P), bit memories (M), temporary 
local data (L), and data (DB and DI). Refer to section “Partial addressing of data op- 
erands” on page 98 for information on what you must observe when addressing da- 
ta operands. 


Register-indirect addressing is possible in two versions: With area-internal register- 
indirect addressing, the address in the address register varies within an operand ar- 
ea. With cross-area register-indirect addressing, the variable address also compris- 
es the operand area. 


With register-indirect addressing, an offset is specified in addition to the address 
register, and is added to the content of the address register during execution of the 
operation without changing the content of the register. This offset has the format 
of an area-internal pointer. You must always specify it, and only as a constant. With 
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indirectly addressed digital operands, this offset must have bit address 0. The max- 
imum value is P#8191.7. 


Refer to Chapter 4.6.2 “Pointer” on page 135 for information on the structure of the 
area pointers used for register-indirect addressing. The statements required for 
working with the address registers are described in Chapter 4.3.3 “Working with 
the address registers with STL” on page 108. 


Examples of area-internal register-indirect addressing 


LAR P#10.0 The address register AR1 is loaded with byte address 10. 
The bit address is 0. 

L MW[AR1, P#0.0] The statement L %MW10 is executed. 

ti MW[AR1, P#2.0] The statement L %MW12 is executed. 

+AR1 P#20.0 The byte address is incremented by 20 in address register 
AR1. 

L MW[AR1, P#0.0] The statement L %MW30 is executed. 

L, MW[AR1,P#4.0] The statement L %MW34 is executed. 

LAR2 P#Q16.3 The address register AR2 is loaded with the pointer to out- 
put bit %Q16.3. 

iN I [AR2, P#0.0] The statement A %I16.3 is executed. 

+AR2 P#0.1 The bit address is incremented by 1 in address register 
AR2 

= M[AR2, P#4.0] The statement = %M20.4 is executed. 


Examples of cross-area register-indirect addressing 


LAR1L P#M64.0 The address register AR1 is loaded with the pointer to 
memory bit %M64.0. 

L W[AR1, P#0.0] The statement L %MW64 is executed. 

L W[AR1,P#2.0] The statement L %MW66 is executed. 

+AR1 P#12.0 The byte address is incremented by 12 in address register 
AR1. 

L B[AR1, P#0.0] The statement L %MB76 is executed. 

L B[AR1,P#4.0] The statement L %MB80 is executed. 

LAR2 P#DB32.0 The address register AR2 is loaded with the pointer to data 
bit %DB32.0. 

f D[AR2, P#0.0] The statement T %DBD32 is executed. 

A [AR2,P#0.1] The statement A %DBX32.1 is executed. 

L, MW[AR2, P#4.0] The statement L %MW36 is executed. 


Fig. 4.6 Examples of register-indirect addressing with STL 
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Area-internal, register-indirect addressing 


With area-internal, register-indirect addressing, the operand area is assigned when 
addressing and cannot be changed. The pointers located in address registers AR1 
and AR2 can be area-internal or cross-area. The operand area which is present in the 
address specification is always used. 


The examples in Fig. 4.6 (top) show area-internal, register-indirect addressing. 


Cross-area register-indirect addressing 


With cross-area register-indirect addressing, the operand area is located together 
with the byte and bit address in the address register. Only the operand width is 
present in the addressing statement, no information for a bit, “B” for a byte, “W” for 
a word, and “D” for a doubleword. The pointer present in address register AR1 or 
AR2 must be cross-area. 


The examples in Fig. 4.6 (bottom) show cross-area, register-indirect addressing. 


4.3.3. Working with the address registers with STL 


The statements available for working with the address registers AR1 and AR2 are 
listed in Table 4.8. A graphic representation of the data flow between the operand 
areas, the address registers AR1 and AR2, and the accumulator 1 is shown in Fig. 
4.7. All statements are executed independent of conditions, and do not influence 
the status bits. 


Table 4.8 Overview of address register functions 


Operation | Operand | Function 

LAR1 Load address register AR1 with the content of accumulator 1 

LAR1 Operand Load address register AR1 with the content of the operand 

LAR1 Pointer Load address register AR1 with the pointer 

LAR1 AR2 Load address register AR1 with the content of address register AR2 
LAR2 Load address register AR2 with the content of accumulator 1 

LAR2 Operand Load address register AR2 with the content of the operand 

LAR2 Pointer Load address register AR2 with the pointer 

TAR1 Transfer the content of address register AR1 to accumulator 1 

TAR1 Operand Transfer the content of address register AR1 to the operand 

TAR1 AR2 Transfer the content of address register AR1 to address register AR2 
TAR2 Transfer the content of address register AR2 to accumulator 1 
TAR2 Operand Transfer the content of address register AR2 to the operand 

TAR Swap the contents of the address registers 

+AR1 Add the content of accumulator 1 to address register AR1 

+AR1 Pointer Add the pointer to address register AR1 

+AR2 Add the content of accumulator 1 to address register AR2 

+AR2 Pointer Add the pointer to address register AR2 
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Statements in association with the address registers 


xx in the statements stands for: 
Bit memory doubleword MD Global data doubleword DBD 
Local data doubleword LD Instance data doubleword DID 
LAR1 xx LAR2 xx 
TAR1 xx TAR2 xx 
LAR1 P#Zy.x TAR1 AR2 LAR2 P#Zy.x 
PP ——> 
LAR1 P#y.x > Address register ‘ LAR1 AR2 Address register LAR2 P#y.x 
AR1 AR2 
+AR1 P#y.x TAR +AR2 P#y.x 
—_—__— <>» 
TAR1 TAR2 
LAR1 LAR2 
+AR1 +AR2 
x = bit address 
Accumulator 1 y = byte address 
Z=area 


Fig. 4.7 Statements for working with address registers 


Loading into an address register 


The LARn statement loads an area pointer into address register ARn (n=1 or 2). You 
can select an area-internal or cross-area pointer or a doubleword from operand ar- 
eas (bit memories, temporary local data, global data, and instance data) as the 
source. The content of the doubleword must correspond to the format of an area 
pointer. 


If you do not specify an operand, LARn loads the content of accumulator 1 into 
address register ARn. 


Using the LAR1 AR2 statement, you copy the content of address register AR2 into 
address register AR1. 


Transferring from an address register 


The TARn statement transfers the complete area pointer from address register ARn 
(n=1 or 2). You can specify a doubleword from operand areas (bit memories, tem- 
porary local data, global data, and instance data) as the destination. 


If you do not specify an operand, TARn transfers the content of address register ARn 
into accumulator 1. The previous content of accumulator 1 is shifted into accumu- 
lator 2 during this procedure; the previous content of accumulator 2 is lost. 


Using the TAR1 AR2 statement you copy the content of address register AR1 into 
address register AR2. 


Swap address register contents 


The TAR statement swaps the contents of address registers AR1 and AR2. Fig. 4.8 
(top) shows an example of application of the statement. 
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Example of swapping address register contents 


8 bytes of data are transferred between the LAR1 P#M100.0 
memory area starting at %MB100 and the LAR2 P#DBX200.0 
data area starting at %DB20.DBB200. The é 
i F ‘ ; F OPN SDB20 
transfer direction is determined by bit " 
memory %M126.6. The contents of the i ee 
address registers are swapped if %M126.6 JC Swap 
has the signal state “0”. TAR 
If you wish to transfer data between two da- Swap: L D[AR1, P#0.0] 
ta blocks in this manner, also load the two aR D[AR2, P#0.0] 
data block registers together with the ad- iL D[AR1,P#4.0] 
dress registers (using OPN and OPNDI) and T D[AR2, P#4.0] 
swap the contents where appropriate using 
the TDB statement. 
Example of adding a pointer to the address register 
A data area of length #Number_ data in data OPN %DB14 
block %DB14 is compared with the #Refer- LAR] P#DBX20.0 
ence_value tag word-by-word starting at da- AR OMEN 
ta word %DBW20. If the reference value is 
larger than the value in the array, a memo- ¥ ES ee 
ry bit is to be set to “1” starting at bit mem- Loop: T Loop counter 
ory %M10.0, otherwise to “0”. L Reference value 
L W[AR1, P#0.0] 
>I 
= AR2, P#0.0] 
+AR1 P#2.0 
+AR2 P#0.1 
L Loop counter 
LOOP Loop 


Example of adding the accumulator content to the address register 


In data block %DB14, the 16 bytes are to be OPN %DB14 

deleted whose addresses are calculated LAR1 %MD220 

from the pointer in bit memory doubleword i 2MB18 

%MD220 and a (byte) offset in memory byte 

%MB18. Prior to addition to AR1, the content Su . 

of %MB18 must be aligned (SLW 3). +ARL 
L 0 
Hy DBD[AR1, P#0.0] 
ity DBD[AR1, P#4.0] 
a DBD[AR1, P#8.0] 
Hy DBD[AR1, P#12.0] 


Fig. 4.8 Examples of register-indirect addressing with STL 


Note: The system blocks BLKMOV and UBLKMOV are available for transferring 
larger data areas. 
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Addition to address register 


A value can be added to the address registers, e.g. to increment the address of an 
operand in program loops each time the loop is executed. You can either enter the 
value as a constant (as area-internal pointer) for the statement, or it is located in the 
right word of accumulator 1. The type of pointer present in the address register 
(area-internal or cross-area) and the operand area are retained. 


The +AR1 P#y.x and +AR2 P#y.x statements add a pointer to the specified address 
register. Note that the maximum size of the area pointer is P#4095.7 with these 
statements. If a value larger than P#4095.7 is present in the accumulator, the num- 
ber is interpreted as a fixed-point number in two's complement and subtracted. Fig. 
4.8 (middle) shows an example of application of the statements. 


The +AR1 and +AR2 statements interpret the value present in accumulator 1 as a 
number in integer format, expand it with the correct sign to 24 bits, and add it to the 
content of the address register. A pointer can also be reduced in this manner. Upward 
or downward violation of the maximum range of the byte address (0 to 65 535) has 
no further effects: The highest bits are “truncated” (Fig. 4.9). 


Addition to address register 


Accumulator 1 


Byten Byte n+1 Byte n+2 Byte n+3 


Isnotconsidered -~—————_ S yyyyyyy yyyyy xX xX x 


(expansion to a 24-bit number) 
x = bit address 


y = byte address SSSSSSSSISyvyvyvyvivvvy yy xxx 
Z = area < | 
S =sign Sign is padded 


Address register 


Byten Byte n+1 Byte n+2 Byte n+3 


1000 O24ZZ2Z40 0 0D OVYWIWvvVyYwvwVy why vv WY WY x x x 


a) ee 
Operand area Byte address Bit address 


Fig. 4.9 Addition to address register 


Note that the bit address is present in bits 0 to 2. If you wish to already increment 
the byte address in accumulator 1, you must add starting with bit 3 (shift the value 
to the left by 3 digits). Fig. 4.8 (bottom) shows an example of application of the 
statement. 


Note: The system block FILL is available for filling in larger data areas with bit pat- 
terns. 
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Notes on use of address register AR1 


STL uses address register AR1 to access block parameters which are transferred as 
DB pointers. With functions (FC), these are all block parameters with complex data 
type, and with function blocks (FB), these are in/out parameters with complex data 


type. 


If you therefore access such a type of block parameter, e.g. in order to scan a bit com- 
ponent of a structure or to write an INT value to an array component, the content of 
address register AR1 is changed and - as aside note - also the content of the DB reg- 
ister. This also applies if you “pass on” block parameters with this data type to called 
blocks. 


If you use address register AR1, access to a block parameter as described above 
must not be carried out between loading of the address register and indirect 
addressing. Otherwise you must save the content of AR1 prior to access, and load it 
again following access (see Fig. 4.10 top). 


Notes on use of address register AR2 


With function blocks with “multi-instance capability”, STEP 7 uses address register 
AR2 as the “base address register” for instance data. When calling a single instance, 
P#DBX0.0 is present in AR2 and all access operations to block parameters or static 
local data in the FB use the register-indirect, area-internal addressing with operand 
area DI via this register. 


Calling of a local instance increases the “base address” with +AR2 P#y.x so that 
access is possible relative to this address within the called function block which 
uses the instance data block of the calling function block. In this manner, function 
blocks can be called either as an independent instance or as a local instance (and in 
this case at any position in a function block, and also more than once). 


If you therefore wish to use address register AR2 in a function block with 
“multi-instance capability”, you must previously save the content and then restore 
it following use. You must not program an access operation to block parameters or 
static local data in the area in which you are working with the address register AR2 
(see Fig. 4.10 bottom). 


With a function block without “multi-instance capability”, the program editor does 
not use address register AR2. The multi-instance capability can be activated or 
deactivated in the block attributes for a function block generated via a source file 
where the keyword CODE_VERSION1 is used. 


There are no limitations to working with the address register AR2 within functions 
(FC). 


Notes on absolute addressing of static local data 


Static local data and block parameters are normally addressed symbolically in the 
program of the “own” function block. In the case of absolute addressing, you must 
note that the function block can be called either as a single instance or as a local 
instance. 
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Example “Save address register AR1” 


Temp Declaration of used intermediate memories 
AR1Memory : DWORD 
DBMemory : WORD 

LAR1 P#y.x Any indirect addressing with AR1 and 

OPN DBz DB register 

L, DBNO Save register contents 

T #DBMemory 


TAR1 #AR1Memory 
L “Motor1”.Actual_value Access to a tag with complex data type 


OPN DB[#DBMemory] Restore register contents 
LARL #AR1Memory 


aD DBW[AR1, P#0.0] Save loaded value 


Example “Save address register AR2” 


Temp Declaration of used intermediate memories 
AR2Memory : DWORD 
DIMemory : WORD 

L DINO Save register contents 

aE #DIMemory 


TAR2 #AR2Memory 


LAR2 P#y.x Any indirect addressing with AR2 and 


OPN 3 DI register 

OPN DI[#DIMemory] Restore register contents 

LAR2 #AR2Memory 

L #Local_ tag Access to block parameters and local tags 


Fig. 4.10 Examples of saving address registers 


The address of the block parameters and static local data specified in the interface 
of the function block is the offset from the beginning of the instance data. It applies 
if you call the function block as a single instance with a separate instance data block; 
assignment of the data operands then commences at address byte zero. 
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Example: A 16-bit tag “Setpoint” in the static local data has the address 32.0, which 
can be read in the block interface in the Offset column following compilation of the 
function block. You can address this tag in absolute mode with %DIW32 in the func- 
tion block's program. However, this only works if you call the function block as a sin- 
gle instance. 


If you call a function block as a local instance, its data is present “in the middle” of 
the instance data block of the calling block (the “multi-instance”). The offset from 
the start of the multi-instance data is present in address register AR2. The absolute 
address of a local tag is then the total of the contents of address register AR2 and the 
address in the called function block (of the local instance). 


Example: A 16-bit tag “Setpoint” in the static local data has the address 32.0. This is 
the offset from the start of the local instance data. The offset from the start of the 
multi-instance data of the calling function block is present in address register AR2. 
The absolute address of this tag is then DIW[AR2,P#32.0] in the program of a func- 
tion block with multi-instance capability. 


Limitations when addressing static local data 


In the case of function blocks without multi-instance capability, you can use all 
statements described in this chapter without limitation. 


In the case of function blocks with multi-instance capability, the program editor ac- 
cesses instance data addressed symbolically by means of the address register AR2, 
i.e. all access operations are carried out indirectly. Symbolic addressing of instance 
data is not possible in conjunction with the address registers or further indirect ad- 
dressing, since in this case the instance data would be addressed indirectly twice. 


Program in function Program in function Program in the function block 
block without multi-in- block with multi-in- with multi-instance capability 
stance capability stance capability and absolute addressing 
Static Sieeieale Sieeeake: Offset 
Pointer : DWORD Pointer : DWORD Pointer : DWORD erat 
Temp 
tPointer : DWORD 
L #Pointer 
#tPointer 
ik MW[#Pointer] L MW[#tPointer] ik MW[DID32] 
LAR1 #Pointer L #Pointer LAR1 %DID32 
LAR1 
TARL #Pointer TARL TAR1 %DID32 
#Pointer 


Fig. 4.11 Examples of use of local data as area pointer 
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If you wish to use local data addressed symbolically in function blocks with multi- 
instance capability as pointers, you must use a “detour” via an intermediate mem- 
ory or accumulator 1. 


Fig. 4.11 (left example) shows the program of a function block without multi-in- 
stance capability. The example in the middle shows the same program in a function 
block with multi-instance capability and symbolic addressing of the local data. The 
example on the right shows the program with absolute addressing of the local data. 


4.3.4 Direct access to complex local tags with STL 


You can access local tags with elementary data types using “normal” STL state- 
ments. Local tags with complex data types or block parameters of type POINTER or 
ANY cannot be handled as an entity. To process such tags, one initially determines 
the start address at which the tag is saved, and then processes parts of the tag using 
indirect addressing. In this way you can also process block parameters with com- 
plex data types. 


Loading of the start address of tags is not possible for tags from the following oper- 
and areas: inputs (I), outputs (Q), peripheral inputs and outputs (I:P and Q:P), bit 
memories (M), and global data operands (DB). 


Loading tag address 
You obtain the start address of a local tag using the statements 


L P##name 
LAR1L P##name 
LAR2 P##name 


where name is the name of the local tag. These statements load a cross-area pointer 
into accumulator 1 or into address register AR1 or AR2. The area pointer contains 
the address of the first byte of the tag. Depending on the logic block used, the tag 
areas specified in Table 4.9 are approved for name. 


Table 4.9 Permissible operands for loading the tag start address 


Operation name isa OB FC FB FB 
with multi- without multi- 
instance instance 
capability capability 
L  P##name Temporary local data Xx x Xx x 
Static local data - - x? x 
Block parameters - x x? x 
LARn P##name_ | Temporary local data x x x x 
Static local data - - x? x 
Block parameters - - x? x 


y Tag address relative to address register AR2 
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In the case of functions (FC), the address of a block parameter cannot be directly 
loaded into an address register. In this case you can use the path via accumulator 1, 
for example with L P##name and LAR1. 


In the case of function blocks without multi-instance capability, the absolute ad- 
dress of the local tag is loaded. 


In the case of function blocks with multi-instance capability, the absolute address 
for the static local data and the block parameters is loaded relative to the start of 
the local instance data. If you wish to determine the absolute address of the tag in 
the data block with multi-instance capability, you must add the area-internal point- 
er of address register AR2 to the loaded tag address. 


You can also apply the loading of a tag address to block parameters. Chapter 18.5 
“Storage of local tags” on page 731 describes how the block parameters are saved in 
the memory and their respective contents. 


Note that LAR2 P##name overwrites address register AR2, which function blocks 
with multi-instance capability use as “start address register” for addressing the 
instance data! 


The two examples at the top in Fig. 4.12 show the program in a function block for 
loading the tag start address into address register AR1 or accumulator 1. Digital op- 
eration AD is only required if the operand area is to be hidden in the address. In the 
bottom example, the tag #First_name is occupied by a different value. 


TAR2 Load the start address of the #name 

LAR1 p##name tag into address register AR1. 

tAR1 

TAR2 Load the start address of the #name 

AD 16#00FF FFFF tag into accumulator 1. 

L P##name 

+D 

Static Processing of a tag with complex data type: 
Pose ments § "Wulsisalseieln’ Load the start address of #First_name tag into 


address register AR1, fetch the offset address 
from AR2 into accumulator 1, and add to the 


LARI Dimi. See content of address register AR1. The start 
ee ar address of #First_name is now present in 
address register AR1. 
tAR1 
; 0 Write 'Marion' into the #First_name tag start- 
L Mari ; 
ing at byte 2 and update the current length of 
eee the STRING tag in byte 1 to a value of 6. 
L ovr 
W[AR1, P#6.0] 
L 6 
B[AR1, P#1.0] 


Fig. 4.12 Examples of loading a tag address 
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4.3.5 Indirect addressing with SCL 


SCL allows indirect addressing of operands and arrays. The addresses of the oper- 
ands and array elements are present in index tags which can be global or local tags 
addressed absolutely or symbolically. With symbolic addressing, the index tags 
must be of data type INT. A constant or an expression with data type INT as a result 
can also be used instead of the index tags. 


Indirect addressing of operands 


With indirect addressing of operands, SCL considers an operand area like an array 
whose elements (bit, byte, word or doubleword) can be addressed individually. 
Example: When addressing MW(#byte_adr), the number of the bit memory word is 
present in the #byte_adr tag. 


Two tags are required to address bit operands, one for the byte address and one for 
the bit address. An operand bit is identified by an “X”. Example: IX(#byte_adr, 
#bit_adr). 


You can address the following operand areas in this manner: 


> Inputs (I), outputs (Q), and bit memories (M) 


> Peripheral inputs (I:P), peripheral outputs (Q:P), in each case without 
bit addressing 


> Data operands (D) in conjunction with a data block which is also indirectly 
addressed (complete addressing). 


SIMATIC timer and counter functions (T and C) cannot be indirectly addressed with 
SCL. 


Fig. 4.13 shows examples of indirect addressing of global operands. A data block is 
indirectly addressed by the conversion function WORD_TO_BLOCK_DB(#db_no_w), 
where the #db_no_w tag is present in data type WORD. The addressing is 
WORD_TO_BLOCK_DB(INT_TO_WORD(#db_no_i)) fora #db_no_i tag with data type 
INT, which one can handle better with arithmetic functions, for example. 


A data block can also be - as a special form of indirect addressing - an input param- 
eter with data type BLOCK_DB. 


If a data block is indirectly addressed, the data operand can only be addressed ab- 
solutely or indirectly. Symbolic addressing is not possible. 


Indirect addressing with data type ARRAY 


With SCL, the component of a tag with data type ARRAY can be dynamically ad- 
dressed. The array index need not only be a constant but can also be a tag or expres- 
sion with data type INT (Fig. 4.14). 


This indirect addressing is also possible with multi-dimensional arrays and with 
the addressing of partial arrays. 
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Examples of indirect addressing of global operands 


byte adr : INT 


bit adr : INT 
var_bool := MX(#byte_adr,#bit_adr); //Address a memory bit 
var byte := IB(#byte adr); 
var_word := IW(#byte adr) :P; //Address an I/O word 
var dword := QD(#byte_ adr); 


(* Copy an I/O area into a memory area *) 

eS 207 

FOR #1 := 48 TO 62 BY 2 DO MW(#k) := IW(#i):P; #k := #k + 2; 
END FOR; 


Examples of indirect addressing of data operands 


lee alclie 8 IDNME 


lgaie @yele TNT 

Glo ime, ak 8 JON 

db no _w : WORD 

var bool := DX(#byte_adr, #bit_adr); //Partial addressing! 
var byte := DB(#byte_ adr); 

var word := DW(#byte_ adr); 

var _dword := DD(#byte adr); 


Examples of indirect addressing of data blocks 


Data : BLOCK_DB //In declaration subsection Input 
byte adr : INT //e.g. local data 

bit adr : INT 

Glo ime. ak 8 NIE 

db no w : WORD 


//The DB index is present with data type WORD 
var_bool := WORD_TO_BLOCK_DB(#db_no_w) .DxX0.0; 
var_bool := WORD_TO_ BLOCK_DB(#db_no_w) .DX(#byte_adr, #bit_adr) ; 


//The DB index is present with data type INT 
var_word := WORD TO BLOCK DB(INT TO WORD (#db_no_i) ) .DWO; 
var word := WORD TO BLOCK DB(INT_TO WORD(#db no _i)).DW(#byte_ adr); 


//The data block is an input parameter 
var_bool := #Data.DX0.0; 
var_bool := #Data.DX(#byte adr, #bit_ adr); 


Fig. 4.13 Examples of indirect addressing of global operands with SCL 
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Examples of indirect addressing of array components 


Array : ARRAY[1...12] OF REAL 


Array _3dim : 
Array_ldim : 


indexl : INT 
index2 : INT 
index3 : INT 


//Indirectly 
#var_ real := 


#var_word := 


//Indirectly 
#Array ldim 


ARRAY[1..4,1..4,1..4] OF WORD 
ARRAY [1..4] OF WORD 


address an array component 
#Array [#indexl]; 
#Array 3dim[#index1, #index2, #index3]; 


eodress a partial array 


:= #Array 3dim[#index1, #index2]; 


Fig. 4.14 Examples of indirect addressing of array components with SCL 


4.4 Elementary data types 


4.4.1 Introduction 


Overview 


Data types define the properties of tags, basically the representation of the contents 
and the permissible ranges. STEP 7 provides predefined data types. The data types 
are globally available and can be used in any block. A distinction is made between: 


Elementary data types, which are predefined and can have a width of up to one 
doubleword (32 bits) 


Complex data types, comprising a combination of elementary data types 


Parameter types as additional data types for transfer of block parameters to 
functions and function blocks 


PLC data types, which a user can compile from existing data types 


System data types with a fixed structure and defined in STEP 7 


Hardware data types defined by the hardware configuration. 


Elementary data types have a width of 1, 8, 16 or 32 bits (Table 4.10). The data types 
BCD16 and BCD 32 are not data types in the closer sense - they cannot be assigned 
to a tag; they are only relevant to data type conversion. The elementary data types 
can be used together with tags from all operand areas. 
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Table 4.10 Overview of elementary data types 


Bit string data types 


Durations and points in time 


BOOL 1 bit 1-bit binary value TIME 32 bits Duration in IEC format 
(0, 1, FALSE, TRUE) T#-24d20h31m23s648ms, 
TIME#24d20h31m23s647ms) 
BYTE 8 bits 8-bit binary value SSTIME 16 bits Duration for SIMATIC times 
(16#00...16#FF) S5T#0ms, SSTIME#2h46m30s) 
WORD 16 bits 16-bit binary value DATE 16 bits Date 
(16#0000...16#FFFF) D#1990-01-01, 
DATE#2168-12-31) 
DWORD | 32bits | 32-bit binary value TIME_OF_ | 32 bits | Time of day 
(16#0000 0000... DAY TOD#00:00:00.000, 


1 6#FFFF FFFF) 


TIME_OF_DAY#23:59:59.999) 


Fixed-point and floating-point numbers 


BCD numbers and characters 


INT 16 bits 16-bit fixed-point number BcD16” 16 bits 3 decades with sign 
(-32 768...+32 767) (-999...+999) 

DINT 32 bits 32-bit fixed-point number BCD32 ” 32 bits 7 decades with sign 
(-2 147 483 648... (-9 999 999...+49 999 999) 
+2 147 483 647) 

REAL 32 bits | 32-bit floating-point number | CHAR 8 bits A character in ASCII code 


(£1.18x107%8...+3.40x 107°) 


Cal Ay 1; sat) 


1) Not a data type in a narrower sense; only relevant to data type conversion 


Overlaying tags (data type views with SCL) 


In the programming language SCL, additional data types can be “overlaid” on block 
parameters and local data. It is then possible to address the contents of tags com- 
pletely or partially using various data types. 


Example: You declare an input parameter with Station as the name and STRING as 
the data type. You transfer the Station tag to a called block in order to process it 
further, e.g. extend it by a number. You additionally wish to determine the current 
length of Station. To do this, you overlay an additional data type definition, for ex- 
ample in the form of a structure with two bytes, on the Station tag. The second byte 
then contains the current length of the string. The additional data type definition 
is to be called Jength, the components are called maximum and current (Fig. 4.15). 


Interface 
Name 
<l v Input 

qj 8 

<q v 
<q s 
a s 


Station 

Length 
maximal 
current 


Data type 


String 
AT... Struct 

Byte 

Byte 


Offset 


Comment 


String with name #Station 


Maximum length of string (#length.maximum) 


Current length of string (#length.current) 


Fig. 4.15 Example of declaration of a “overlaid” data type 
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You initially declare the tag with the “original” data type and with any default set- 
ting. In the next line you write the tag which is to be “overlaid” on the one above it. 
You then write the keyword AT in the “Data type” column to indicate that this is a 
“overlaid” data type definition, and then complete the input using the RETURN key. 
You subsequently assign this tag with the additional data type envisaged for it. 


You can overlay several data type definitions over a tag which you differentiate by 
different names. A default setting with fixed values (initialization) is not possible. 


The memory requirements of the overlaying data type definition must not be great- 
er than the “original” tag (the new data type must “fit” into the tag). 


You use a overlaying data type definition like any other tag, but only locally in the 
block. In the above example, the calling block writes a string into the input 
parameter Station; the overlaying data type definition as a byte structure is not ac- 
cessible to it. 


Table 4.11 shows which overlaying data type definitions you can position over a tag 
with specific data type. If, for example, the tag is in the temporary local data of an 
FC and is a complex data type, the data type definitions overlaid on it can be of data 
types: elementary, complex, as well as ANY. 


Tags of type TIMER, COUNTER, and BLOCK_xx as well as the function value with 
functions (FC) cannot be overlaid by data types. 


Table 4.11 Permissible data types for overlaying 


Block | The tag is The tag is of data type 

declared in 

the block Elementary Complex POINTER ANY 
FC NPUT E Cc 

OUTPUT E Cc 

NOUT E Cc 

TEMP E C E ie A e 
FB NPUT E G E Cc P A ie Cc 

OUTPUT E ¢ E C 

NOUT E C 

STATIC E Cc E C 

TEMP E Cc E G A a 
Overlaying data type: 
E Elementary (BOOL, CHAR, BYTE, WORD, DWORD, INT, DINT, REAL, SSTIME, TIME, DATE, TIME_OF_DAY) 


C Complex (DATE_AND_TIME, STRING, ARRAY, STRUCT) and PLC data types 
P POINTER 
A ANY 
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4.4.2 Bit-serial data types BOOL, BYTE, WORD, and DWORD 


A tag with data type BOOL represents a bit value (e.g. input %I1.0). The tag can have 
the value “O” or “1”, or FALSE or TRUE. 


A tag with data type BYTE occupies 8 bits. The individual bits have no significance. 
The hexadecimal notation for constants is B#16#00 to B#16#FF. 


A tag with data type WORD occupies 16 bits. The individual bits have no significance. 
The hexadecimal notation for constants is W#16#0000 to W#16#FFFF. A constant of 
word width can also be written as a 16-bit binary number (2#0000_..._0000 to 
2#1111_..._1111) or as a 2x8-bit unsigned decimal number B#(0,0) to B#(255,255). 


A tag with data type DWORD occupies 32 bits. The individual bits have no signifi- 
cance. The hexadecimal notation for constants is DW#16#0000_ 0000 to 
DW#16#FFFF_FFFF. A constant of doubleword width can also be written as a 32-bit 
binary number (2#0000_... 0000 to 2#1111_..._ 1111) or as a 4x8-bit unsigned dec- 
imal number B#(0,0,0,0) to B#(255,255,255,255). 


Fig. 4.16 shows the structure of the data types BYTE, WORD, and DWORD. 


4.4.3 BCD numbers BCD16 and BCD32 


BCD numbers do not have their own data type. For a BCD number, use the data type 
WORD or DWORD and enter only the numbers 0 to 9 or 0 and F for the sign in the 
hexadecimal form W#16#xxxx or DW#16#xxxx_Xxxx. 


BCD numbers are used, for example, in association with the conversion functions. 
The sign of a BCD number is located in the left-justified (highest) decade. Thus one 
decade is lost for the number range (Fig. 4.16). 


The sign of a BCD number present in a 16-bit word is in the bits 12 to 15, where only 
bit 15 is relevant. Signal state “O” means that the number is positive. Signal state 
“1” represents a negative number. The sign does not influence the assignment of 
the individual decades. 


The sign of a BCD number present in a 32-bit word is in the bits 28 to 31. 


The numerical range available for 16-bit BCD numbers is 0 to +999, and for 
32-bit BCD numbers 0 to + 9 999 999. 


4.4.4 Fixed-point data types with sign INT and DINT 


With the fixed-point data types with sign, the signal state of the highest bit rep- 
resents the sign. Signal state “O” means that the number is positive. Signal state “1” 
represents a negative number. The representation of a negative number is as a 
two's complement. 


The data type INT (integer or fixed-point number) occupies one word. The numeri- 
cal range extends from -2' to +2!5-1, i.e. from -32 768 to +32 767 or in hexadeci- 
mal notation from W#16#8000 to W#16#7FFF. 
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Data type BYTE 


Byte m 
ee 


Bitnumber 76543210 


Data type WORD 


Byte m Byte m+1 


Data type DWORD 
Byte m Byte m+1 Byte m+2 Byte m+3 
Bil 24 23 16 15 Se W 0 


Sign: 000 0=positive ey RE YE 
1111-=negative Sign 102 10! 10° 


BCD number, 7 decades 


Byte m Byte m+1 Byte m+2 Byte m+3 


3| 28 27 24 23 ZO) Bio) 16 15 12y i 8 7 4 3 0 


A ie eo a ee 
Sign 10° 10° 10 10° 107 10! 10° 


Data type INT 
S = sign: 0 = positive 
1 =negative S)2s eo) Bie Revo 
Data type DINT 
31 30... 16015... 0 
Gi Aa (ce HOS On BD) 12a 28, 
Data type REAL 
31 30... 42 23) = 22.0% “O0 
Sy bee Ce aes Peg 
e_F —_—_—_—_—_ !————— eer 
Exponent Mantissa 
Fig. 4.16 


Structure of bit-serial and BCD data types as well as of data types INT, DINT, and REAL 
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The data type DINT (double integer or fixed-point number) occupies one doubleword. 
The numerical range extends from -2*! to +27!-1, ie. from -2 147483 648 to 
+2 147483647 or in hexadecimal notation from DW#16#8000_0000 to 
DW#16#7FFF_FFFF (Fig. 4.16). 


An integer is saved as a DINT tag if it is larger than +32 767 or smaller than -32 768, 
or if the number is preceded by L# as type ID. 


Example with STL: Using L -100 you load an INT number; using L L#-100 a 
DINT number. The difference is in the occupation of the left word in accumulator 1: 
In the example of the INT number -100, the value W#16#0000 is present here; with 
the DINT number -100, the sign W#16#FFFF. 


Example with SCL: If you specify the constant value -100, the program editor 
automatically converts the value into a DINT number if it is linked to a DINT tag 
(“implicit” data type conversion). 


4.4.5 Floating-point data type REAL 


A tag with data type REAL represents a fractional number which is saved as a float- 
ing-point number. A fractional number is entered either as a decimal fraction 
(e.g. 123.45 or 600.0) or in exponential form (e.g. 12.34e12 corresponding to 
12.34-10!). The representation comprises 7 relevant positions (digits) which are 


positioned in exponential form in front of the “e” or “E”. The value following “e” or 
“BE” is the exponent to base 10. 


Conversion of the REAL tags into the internal representation of a floating-point 
number is handled by the program editor. Table 4.12shows the internal range limits 
of a floating-point number. 


The CPUs calculate with the full accuracy of the floating-point numbers. The dis- 
play on the programming device may deviate from the theoretically exact represen- 
tation as a result of rounding-off errors during the conversion. 


Table 4.12 Internal range limits of a floating-point number 


Sign Exponent Mantissa Meaning 

0 255 Not equal to 0 Not a valid floating-point number (+NaN, Not a Number) 
0 255 0 +inf, Infinity 

0 Wee 254 Any Positive, normalized floating-point number 

0 0 Not equal to 0 Positive, denormalized floating-point number 

ie) 0 0 + zero 

1 0 0 — zero 

1 0 Not equal to 0 Negative, denormalized floating-point number 

1 1... 254 Any Negative, normalized floating-point number 

1 255 0 — Inf, Infinity 

1 255 Not equal to 0 Not a valid floating-point number (—NaN, Not a Number) 
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REAL data type 


A distinction is made for the REAL tags between numbers which can be represented 
with full precision (“normalized” floating-point numbers) and numbers with a 
reduced precision (“denormalized” floating-point numbers). 


The valid range of values of a REAL tag (normalized 32-bit floating-point number) 
is between the limits: 


-3.402 823 x 10*°8 to -1.175 494 x 1078 
+0 
4+1.175 494 x 107° to +3.402 823 x 10*°8 


A denormalized floating-point number can be between the limits: 


-1.175 494 x 10738 to -1.401 298 x 10°* 
and 
+1.401 298 x 10°* to +1.175 494 x 10738 


A tag with data type REAL consists internally of three components: the sign, the 
8-bit exponent to base 2, and the 23-bit mantissa. The sign can have the values “0” 
(positive) or “1” (negative). The exponent is saved increased by a constant (bias, 
+127) so that it has a range of values from 0 to 255. The mantissa represents the 
fractional part. The whole number part of the mantissa is not stored, because it is 
always equal to 1 within the valid range of values (Fig. 4.16). 


4.4.6 Data type CHAR 


A tag with data type CHAR (character) occupies one byte. The data type CHAR rep- 
resents a single character which is saved in ASCII format. Example: 'A'. A single char- 
acter of a tag with the data type STRING has the data type CHAR and can also be used 
accordingly. Example: If Author is the name of the string with the content ‘Berger’, 
then the tag Author[1] has the value 'B' and the data type CHAR. 


The notation shown in Fig. 4.17 is available for a number of special characters in 
association with an STL load statement. Example: L ‘$$’ loads a dollar sign in ASCII 
code. One, two or four characters can also be present for a load statement: The load 
statement L'a' loads one character (in this case an a), L'aa' loads two characters, and 
L 'aaaa' loads four characters right-justified into accumulator 1. 


Data type CHAR 


Byte m Special characters for CHAR 
‘ CHAR HEX Meaning 
Bit GES $$ 24 hex Dollar symbol 
5 $ 27 hex Single inverted comma 
ASCII code $L or $1 OA hex Line feed (LF) 

$R or $r OD hex Carriage return (CR) 
$P or $p OC hex Form feed (FF) 
$T or $t 09 hex Tabulator 


Fig. 4.17 Structure of the CHAR data type 
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4.4.7 Data types for durations and points in time 


Data type SSTIME 


A tag with data type S5TIME is used for the duration of a SIMATIC timer function. It 
occupies a 16-bit word with 1+3 decades (Fig. 4.18). 


The time duration is displayed in hours, minutes, seconds, and milliseconds. Con- 
version into the internal representation is handled by STEP 7. The internal repre- 
sentation is a BCD number from 000 to 999. The time frame can adopt the following 
values: 10 ms (0000), 100 ms (0001), 1 s (0010), and 10 s (0011). The duration is the 
product of the time frame and time value. Examples: 


SSTIME#500ms (= W#16#0050) 
S5ST#2h46m30s (= W#16#3999) 


DATE 


A tag with data type DATE is saved in a word as an unsigned fixed-point number. The 
content of the tag corresponds to the number of days since 01.01.1990. The repre- 
sentation contains the year, month, and day, each separated by a dash (Fig. 4.18). 
Examples: 


DATE#1990-01-01 (= W#16#0000) 
D#2168-12-31 (= W#16#FF62) 


Data type SSTIME 


bo gare ee): 
Time base: 0000 10ms 0 2 1 0 
0001 100ms ne ut ae 
0010 se ||| Sa 
0011 10s Time base Time value 
Data type DATE 
5 ae 
215 Beery lee - zn 
Data type TIME 
31 we 16 15.. 
g 230 924 923 916 a3 98 97 m5 
S = sign: 0 = positive 
1 =negative 
Data type TIME OF DAY 
16 15.. 
a eee Oe. a 26 215 2s) hoe a i 


Fig. 4.18 Bit assignment of data types SSTIME, DATE, TIME, and TIME_OF_DAY 
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TIME data type 


A tag with data type TIME (duration) occupies a doubleword. The representation con- 
tains the data for days (d), hours (h), minutes (m), seconds (s) and milliseconds (ms), 
whereby individual time units can be omitted. If more than one time unit is specified, 
the values for the time units are limited: Days from 0 to 24, hours from 0 to 23, min- 
utes and seconds from 0 to 59, and milliseconds from 0 to 999 (Fig. 4.18). 


The content of the tag is interpreted as milliseconds (ms), and saved as a 32-bit 
fixed-point number with sign. The range of values extends from 
TIME#-24d20h31m23s648ms to TIME#24d20h31m23s647ms. 


TIME_OF_DAY 


A tag with data type TIME _OF_DAY occupies a doubleword. It contains the number 
of milliseconds since the beginning of the day (0:00 o'clock) as an unsigned fixed- 
point number. The representation contains the data for hours, minutes, and sec- 
onds, each separated by a colon. The specification of milliseconds, which follows 
the seconds and is separated by a dot, can be omitted (Fig. 4.18). Examples: 


TIME _OF_DAY#00:00:00 (= DW#16#0000_0000) 
TOD#23:59:59.999 (= DW#16#0526_5BFF) 


4.5 Complex data types 


Compound data types consist of a combination of elementary data types under one 
name (Table 4.13). These data types can only be used locally in the interface of logic 
blocks and in data blocks; they are not approved for the following operand areas: 
inputs (I), outputs (Q), and bit memories (M) in the PLC tag table. 


Table 4.13 Overview of complex data types 


Data type Length Meaning, remark 


DATE_AND_TIME_ | 8 bytes Date and time 
Example: DT#1990-01-01-00:00:00 


STRING 2+n bytes A string with n characters. 
Examples: ‘Hans’, ‘Motor switched off' 


ARRAY Variable A combination of several equivalent data types. 

Example: The tag Setpoint has the data type ARRAY[1..32] of INT. 
The individual components are then: 
Setpoint[1]; Setpoint[2]; ...; Setpoint[32] 


STRUCT Variable A combination of several different data types. 

Example: The tag Valve has the data type STRUCT. 
It can then contain the components: 
Valve.Switch_on; Valve.Switch_off; Valve.Fault; etc. 
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4 Tags, addressing, and data types 


DATE_AND_TIME 


The data type DATE_AND_TIME represents a specific point in time consisting of a 
date and time. You can use the abbreviation DT instead of DATE_AND_TIME. 


A tag with data type DATE_AND_TIME occupies 8 bytes. Saving in the memory com- 
mences at a byte with even address. All values are present in BCD format (Fig. 4.19). 


Data type DATE_AND_TIME (DT) 


Add Assignment R 
Tess ; ae , g ange 
Byten” 10 10° Year 0 to 99 
Byte n+1 10! 10° Month 1 to 12 
Byte n+2 10 10° Day 1 to 31 
Byte n+3 10! 10° Hours 0 to 23 
Byte n+4 10 10° Minutes 0 to 59 All data in 
BCD format 
Byte n+5 10! 10° Seconds 0 to 59 i 
) n=even 
Byte n+6 102 10! Milliseconds 0 to 999 
Byte n+7 10° 10° Day of the week 1 = Sunday to 7 = Saturday 


Fig. 4.19 Structure of data type DATE_AND_TIME (DT) 


4.5.1 STRING data type 


The data type STRING represents a string consisting of two bytes for the length data 
and up to 254 bytes for the characters in ASCII code. Saving in the memory com- 
mences at a byte with even address. The program editor reserves an even number 
of bytes for a string. 


When declaring a STRING tag, its maximum length is defined in square brackets. 
The current length is entered for the default setting or when processing the string 
(the actually used length of the string = number of valid characters). The maximum 
length is present in the first byte of the string, the second byte contains the current 
length; this is followed by the characters in ASCII format (Fig. 4.20). 


Example: The tag Machine is to be defined with a maximum length of 12 characters 
and should have 'Drill' as the default setting. 


Machine : STRING [12] := 'Drill' 


The first byte of the tag then has the value 12, the second byte the value 6, the third 
byte the character “B” etc. 


When declaring a STRING tag as the block parameter of a function (FC), only a 
length of 254 can be assigned. If no length is specified in the declaration of a 
STRING tag, the program editor applies the standard length of 254 characters. 
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Data type STRING 


Byte No. Range The maximum length must be 
n” Maximum length 0to 254 —(k) greater than or equal to the 
current length: k=>m 
n+1 Current length 0to254 (m) 
n+2 1st character ASCII code 
n+3 2nd character ASCII code Current 
ASCII code length (m) Maximum 
n+m+1 m-th character ASCII code lenge) 
n+k+1 ah - Siac 


Fig. 4.20 Structure of STRING data type 


A STRING tag cannot be assigned a default value when declared in the temporary lo- 
cal data. The content of the tag is then undefined. Prior to use, the tag must first be 
assigned a valid content (per program). 


A constant with data type STRING is written with single quotation marks, for exam- 
ple 'Hans Berger’. If the single quotation mark is to be a character of the tag, it must 
be preceded by a dollar sign ($'). 


The characters in a STRING tag can also be addressed individually (not with SCL). 
The first character (the third byte) is accessed using Tag_name[1], the n-th charac- 
ter using Tag_name[n]. The individual components have the data type CHAR. In the 
above example, the tag Machine[3] has the character 'h’. 


Special functions are available for processing STRING tags, for example to separate 
a partial string or to combine two STRING tags into a single one (see Section 13.9 
“Functions for strings” on page 556). 


4.5.2 Data type ARRAY 


The data type ARRAY represents a data structure comprising a fixed number of com- 
ponents with the same data type (Fig. 4.21). All data types are permissible except 
ARRAY. 


A tag with data type ARRAY commences at a byte with even address. Components 
with data type BOOL commence in the least significant bit; components with data 
type BYTE and CHAR in the right byte. The individual components are listed consec- 
utively. The program editor reserves an even number of bytes for an array tag. 


The data type ARRAY can have up to 65 536 components. When creating an ARRAY 
tag, the number range of the components is specified in square brackets, and the data 
type following the keyword OF. The number range extends from -32 768 to 32 767. 
The lower range value must be smaller than the upper value. 
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4 Tags, addressing, and data types 


Date type ARRAY (one-dimensional) 


The memory location of an ARRAY tag always commences at a byte with even address. The program 
editor always reserves an even number of bytes for an ARRAY tag. 


Bitnumber 7 6 5 43 210 


Byte n”? S(7IO/ 514/312] 1 Array of bit-wide components 
Byte n+1 oa fore | ose | exo | IAF MO) 
Byte n? Byte 1 Array of byte-wide components 
Byte n+1 Byte 2 
Byte n+2 Byte 3 
Byte n+3 GUC. 
3) 
Byte n Array of word-wide or doubleword-wide 
mere | components 
Byte n+1 
Byte n+2 
Word 2 
Byte n+3 
Byte n+4 
etc. 
Byte n+5 )n=even 


Date type ARRAY (multi-dimensional) 


Byte n? #Arraytag[1,1,1] 
2nd dimension 


Byte n+1 #Arraytag[1,1,2] 
Byte n+2 #Arraytag[1,2,1] 
2nd dimension ? 1st dimension 
Byte n+3 #Arraytag[1,2,2] 
Byte n+4 #Arraytag[1,3,1] 
2nd dimension 
Byte n+5 #Arraytag[1,3,2] 
Byte n+6 #Arraytag[2,1,1] 
Byte n+7 #Arraytag[2,1,2] Example of the byte assignments of 
the #Arraytag tags with the data type 
Byte n+8 #Arraytag[2,2,1] ARRAY[1..2,1..3,1..2] OF BYTE 
Byte n+9 #Arraytag[2,2,2] 
Byte n+10 #Arraytag[2,3,1] 
Byte n+11 #Arraytag[2,3,2] ‘Yn = even 


Fig. 4.21 Structure of data type ARRAY 
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4.5 Complex data types 


The index is a fixed value with LAD/FBD/STL and cannot be changed during runtime 
(variable indexing not possible). With SCL, the index can also be a tag or an expres- 
sion with data type INT (see Chapter 4.3.5 “Indirect addressing with SCL” on page 
117). 


Example: A tag with the name Measured value is to have 16 components of data type 
INT which are numbered commencing with 1. 


Measured value : ARRAY[1..16] OF INT 


The components of an ARRAY tag can be addressed individually and can be handled 
like tags with the same data type. For example, the component Measured value[10] 
on a block parameter can be created with the data type INT. 


Multi-dimensional arrays 


Arrays can have up to 6 dimensions. The same applies as to one-dimensional arrays. 
The dimension areas are written in the declaration in square brackets, each separat- 
ed by a comma (Fig. 4.21). 


When addressing the components of multi-dimensional arrays, you must always 
specify the indices of all dimensions for LAD/FBD/STL. 


Addressing of partial arrays is possible with SCL: With multi-dimensional arrays, 
you can handle the partial arrays like correspondingly dimensioned tags: You omit 
array indices starting from the right, and obtain a partial area of the original array 
with a smaller dimension. 


Example: #Array1 : ARRAY [1..8,1..16] OF INT represents a two-dimensional array; 
you can now address the complete array using #Array1, a partial array using #Ar- 
ray1[i] (corresponds to the lines of the matrix), and an array component using #Ar- 
ray1[i,j]. 


The partial array #Array1 [i] can now be assigned to a correspondingly dimensioned 
array, e.g. #Array2 := #Array1[i], where i=1 to 8 and #Array2 : ARRAY [1..16] OF INT. 


In the multi-dimensional arrays, the components are saved starting with the first 
dimension. With bit and byte components, a new dimension always commences in 
the next byte, with components of other data types always in the next word (in the 
next byte with even address). 


4.5.3 Data type STRUCT 


The STRUCT data type represents a data structure comprising a fixed number of 
components with different data types (Fig. 4.22). All data types are permissible, 
including the PLC data types. 


A tag with STRUCT data type commences at a byte with even address, followed by the 
components in the declared sequence. Components with the BOOL data type com- 
mence in the least significant bit of the next vacant byte, components with the BYTE 
or CHAR data type in the next vacant byte. Components with other data types com- 
mence at a byte with even address. The program editor reserves an even number of 
bytes for a STRUCT tag. 
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4 Tags, addressing, and data types 


Data type STRUCT 


A tag of data type STRUCT commences at a byte with even address, and always occupies an even number 
of bytes. 


76543210 


Byten” BIO) S)e1 3) 214 Bit components 

Byte n+1 ox [ox [ow | IZING] 10] 9 

Byte n+2 Byte 1 Byte components 

Byte n+3 Byte 2 

Byte n+4 Byte 3 

Byte n+5 (Filler byte) 

Byte n+6 Word components 
Word 1 

Byte n+7 or 

Byte n+8 Doubleword components 
Word 2 

Byte n+9 

Byte n+10 ns Pees Reva ree bbe) Sele tal Bit components 

Byte n+11 Byte 1 Byte component 

Byte n+12 
etc. . 

Byte ... )n=even 


Data type STRUCT, nested structure 


A tag of data type STRUCT commences at a byte 


*) with even address, and always occupies an even 
Byte n Data type 1 number of bytes. 
Data type 2 
. amccniat nnn pe=emameamniieanteaindia . 
Byte m j STRUCT Data type 3 
I q 
i Data type 4 H 
* | [ike ce eaA oe oe Dea cae [| --------------------5 
Byte p” | STRUCT Data type 5 
: I : 1 
Data type 6 
: i I 
r i ; Data type 7 H 
*) I a a a] 
Byte q Data type 8 i 
Data type 9 | 
Bytes ” Data type 10 
Data type 11 
Data type 12 *) Byte with even number 


Fig. 4.22 Structure of STRUCT data type 
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4.6 Parameter types and pointers 


When declaring a STRUCT tag, the tag name with the STRUCT data type is specified 
first, followed underneath by the individual components with their own data type. 


Example: A tag with the name Fan is to comprise four components: Switch on 
fan (BOOL), Switch off fan (BOOL), Speed (INT), and Delay (TIME). 


Fan : STRUCT 


Switch on fan : BOOL := FALSE 
Switch off fan : BOOL := FALSE 
Speed : INT = 0 

Delay : TIME := T#0ms 


A component of a STRUCT tag can also be addressed individually by positioning the 
name of the structure, separated by a dot, in front of the component name. A STRUCT 
component can be handled like a tag with the same data type. For example, the com- 
ponent #Fan.Speed can be created on a block parameter with the INT data type. 


Nested structures 


A nested structure contains at least one further structure as component. A nesting 
depth of up to 8 levels is possible. All components can be addressed individually 
provided they have an elementary data type. The individual names are each sepa- 
rated by a dot. 


Example: StructureTag.Structure_Level2.Component_Level2. 


4.6 Parameter types and pointers 


4.6.1 Parameter types 


The parameter types are additional data types for block parameters (Table 4.14). 
The length data in the table refers to the memory requirements of the block param- 
eter when transferring to the called block. 


TIMER and COUNTER parameter types 


The SIMATIC timer and counter functions transferred at the block interface are of 
parameter types TIMER and COUNTER. These types of block parameter can only be 
declared in the declaration subsection Input. The content of the block parameter is 
the number of the transferred timer and counter operands. 


TIMER and COUNTER are also used in the PLC tag table as data types for SIMATIC 
timer and counter functions. 


BLOCK_xx parameter types 


The blocks transferred at the block interface are of the parameter types BLOCK_xx 
(xx stands for the block type, see Table 4.14). Blocks transferred with BLOCK_FC 
or BLOCK_FB can only be processed to a limited extent in the called block (see 
Chapter 14.4.4 “Change to a block without block parameter” on page 581). The 
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4 Tags, addressing, and data types 


Table 4.14 Overview of parameter types 


Parameter type Description Examples of actual parameters 

TIMER SIMATIC timer function 16 bits T 15 orname 

COUNTER SIMATIC counter function | 16 bits C 16 or name 

BLOCK_DB Data block 16 bits DB 19 or name 

BLOCK_FC Function 16 bits FC 17 or name 

BLOCK_FB Function block 16 bits FB 18 or name 

VOID Function value without - Without actual parameter (only with functions 

ype FC) 

POINTER DB pointer 48 bits As pointer: P#M10.0 or P#DB20.DBX22.2 
As operand: MW 20 or! 1.0 or #Name 

ANY ANY pointer 80 bits As area: P#DB10.DBX0.0 WORD 20 
or any (complete) tag 


BLOCK_DB parameter type is of practical significance since it can be used to trans- 
fer and call data blocks as block parameters (see Chapter 14.5.1 “Opening a data 
block” on page 583). 


A block parameter with the BLOCK_xx parameter type can only be declared in the 
declaration subsection Input. The content of the block parameter is the number of 
the transferred block. 


Parameter type VOID 


The VOID parameter type (= without type) is used for the value of functions FC if the 
function value is not to be displayed. Additional information on the function value 
can be found in section “Using a function value of a function (FC)” on page 167. 


POINTER parameter type 


A tag with elementary data type is transferred at a block parameter of the type 
POINTER. Such a block parameter can be declared in the declaration subsections 
Input and InOut, and with functions (FC) also in the subsection Out. The content of 
the block parameter is a DB pointer which points to the actual parameter to be 
transferred (see Chapter 4.6.2 “Pointer” on page 135). 


ANY parameter type 


A tag with any data type or a data area is transferred at a block parameter of the type 
ANY. Such a block parameter can be declared in the declaration subsections Input 
and InOut, and with functions (FC) also in the subsection Out. The content of the 
block parameter is a ANY pointer which points to the actual parameter to be trans- 
ferred (see Chapter 4.6.2 “Pointer” on page 135). 
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4.6 Parameter types and pointers 


4.6.2 Pointer 


Introduction 


An address for indirect addressing must be formatted such that it contains the bit 
address, the byte address, and possibly also the operand area. It therefore has a spe- 
cial format referred to as pointer. A pointer is used to point as it were to an operand. 


Three types of pointers are possible with STEP 7: 


> Area pointers; these have a length of 32 bits and contain a specific operand or 
its address 


> DB pointers; these have a length of 48 bits and contain the number of the data 
block in addition to the area pointer 


> ANY pointers; these have a length of 80 bits and contain further data such as 
the data type of the operand in addition to the DB pointer 


The area pointer is used in STL for indirect addressing, the DB pointer for a block 
parameter of the type POINTER, and the ANY pointer for a block parameter of the 
type ANY. 


Area pointer 


The area pointer contains the operand address and possibly also the operand area. 
Without an operand area, it is an area-internal pointer. If the pointer also contains 
the operand area, one refers to a cross-area pointer. The two types of pointer are dis- 
tinguished by the assignment of bit 31 (Fig. 4.23). 


You can load an area pointer as a constant into accumulator 1 or into one of the 
address registers. The notation for this is as follows: 


P#y.x for an area-internal pointer (e.g. P#22.0) and 
P#Zy.x for across-area pointer (e.g. P#M22.0) 


where x = bit address, y = byte address, and Z = area. Specify the operand ID as the 
area (I, Q, M, DBX, DIX, L, and P). With the peripheral operand area (P), the opera- 
tion (load or transfer) used during application of the pointer distinguishes whether 
the peripheral inputs (I:P) or the peripheral outputs (Q:P) are addressed. 


The area pointer always has a bit address which also always has to be specified for 
digital operands; the bit address is 0 (zero) for digital operands. You can use the ar- 
ea pointer P#M22.0, for example, to address the memory bit M 22.0, but also the 
memory byte MB 22, the memory word MW 22, or the memory doubleword MD 22. 


DB pointer 


ADB pointer also contains, supplementary to the area pointer, a data block number 
as a positive integer. It specifies the data block if the area pointer contains the global 
data (DBX) or instance data (DIX) operand areas. In all other cases, zero is present 
instead of the data block number (Fig. 4.23). 
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Pointers for indirect addressing 


Area-internal pointer 


Byten Byte n+1 Byte n+2 Byte n+3 


OVOODMDODODOOFOOOODYW ¥ Viv vv VY WW W WEY VW WoW % oe x 
10. IH 
Byte address Bit address 


Cross-area pointer 


Byte n Byte n+1 Byte n+2 Byte n+3 


100O0O0AZAAIUVOOOUDY 7 Vi vy ¥ vv v VY Vy WV Wy Re & 
Ve" — —oo§4@wi_e iy ui OqoeuwKe-—_’ 
Operand area Byte address Bit address 


ANY pointer ANY pointer ANY pointer 


for data types for timers/ for blocks 
counters 
Byte n 16#10 16#10 16#10 
Byte n+1 Type Type Type 
Byte n+2 
Quantity Quantity Quantity 
DB pointer Byte n+3 
Byte n Data block Byte n+4 Data block 
16#0000 16#0000 
Byte n+1 number Byte n+5 number 
Byte n+2 Byte n+6 Type 
16#0000 
Byte n+3 Area Byte n+7 Area 16#00 
Byte n+4 pointer Byte n+8 pointer 
Number Number 
Byte n+5 Byte n+9 
Operand area in the area pointer: Type in the ANY pointer 


Elementary Compound 


0 O O. Peripherals (P) 
0 0 1 Inputs () data types data types 
0 1 =O Outputs (Q) 
: : 01 BOOL OE DT 
0 1 1. Bit memories (M) 02 BYTE 13 STRING 
1 0 O- Global data (DBX) 03 CHAR 
1 O 1 Instance data (DIX) 04 WORD Parameter types 
1 1 0 - Temporary local data (L) 05 INT 
111 Temporary local data ) 06 DWORD 19 BLOCK_DB 
of preceding block (V) 07 DINT 1C COUNTER 
08 REAL 1D TIMER 
1) Not with cross-area addressing 09 DATE 
Only with transfer of block parameters OA TOD Zero pointer 


OB TIME 
OC S5TIME 00 NIL 


Fig. 4.23 Structure of pointers for indirect addressing 
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4.6 Parameter types and pointers 


You have already become acquainted with the pointer's notation in the complete 
addressing of data operands. The data block and the data operand are also specified 
here separated by a dot: P#Data_block.Data_operand. 


Example: P#DB10.DBX20.5 


You cannot load this pointer using a load statement; however, you can apply it to a 
block parameter of the type POINTER (not with SCL). The POINTER parameter type 
has the structure of a DB pointer. 


ANY pointer 


Supplementary to the DB pointer, the ANY pointer also contains the data type and a 
repetition factor. It is then possible to point to a data area (addressed absolutely) in 
addition to tags. 


You can apply an ANY pointer to a block parameter of the type ANY (not with SCL). 
The ANY parameter type has the structure of an ANY pointer. 


The ANY pointer is available in two versions: for tags with data types and for tags 
with parameter types. Tags with elementary data types, DT, and STRING are 
assigned the type shown in Fig. 4.23 and the quantity 1. 


If you apply a tag with the data types ARRAY, STRUCT, or a PLC data type to an ANY 
parameter, the program editor generates an ANY pointer to the data array or the da- 
ta structure. This ANY pointer contains the ID for BYTE (B#16#02) as the type, and 
as quantity the number of bytes of the tag length. The data type of the individual 
array or structure components is insignificant. Thus an ANY pointer points to a 
WORD array with double the number of bytes. Exception: A pointer to an array of 
components with data type CHAR is also applied with CHAR type (B#16#03). 


The representation of a constant for tags with data types or for data areas is as 
follows: P#[Data_block.]Operand Type Quantity 


Examples: 


> P#DB11.DBX30.0INT12 Area with 12 words in the %DB11 starting at %DBB30 


> P#M16.0 BYTE 8 Area with 8 bytes starting at %MB16 
> P#I18.0 WORD 1 Input word %IW18 
> P#I1.5 BOOL1 Input %11.5 


With parameter types you write the pointer: Lt Number Type Quantity 


Examples: 
> L#10 TIMER 1 Timer function %T10 
> L#2 COUNTER 1 Counter function %C2 


The program editor then applies an ANY pointer which agrees with the data in the 
representation of the constant with regard to type and quantity. Note that the oper- 
and address in the ANY pointer for data types must always be a bit address. 
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You can also use the parameter type ANY to declare tags in the temporary local data. 
You use these tags to generate an ANY pointer which can be changed during 
runtime (“variable” ANY pointer). 


4.6.3 “Variable” ANY pointer with STL 


An ANY pointer in the representation of a constant P#Operand Type Quantity points 
to a data area with fixed address. If a tag is applied to an ANY block parameter, for 
example a tag with the data type ARRAY, the program editor generates a constant 
ANY pointer to this tag. In neither case is it possible to change or redefine the tag or 
data area during runtime. 


An exception is made by the program editor if the actual parameter itself is in the 
temporary local data and is of the type ANY. No other ANY pointer is then produced; 
in this case the program editor interprets this ANY tag as an ANY pointer to an ac- 
tual parameter. This means that the ANY tag must be formatted like an ANY pointer 
and written with the required data in the user program prior to its use. 


Like with indirect addressing, the addresses are only known during runtime, and 
the danger therefore exists that memory areas can be overwritten unintentionally. 
The automation system could then react in an unexpected manner! Therefore be 
extremely careful when using the “variable” ANY pointer! 


Fig. 4.24 shows an example of application of the “variable” ANY pointer. It contains 
the program for a function (FC) which transfers a data area from one data block to 
another, where the address and length of the area can be changed during runtime. 
Writing of the ANY tag is programmed in two different manners depending on 
whether the address of the ANY tag is known in the temporary local data or not. 
When calling the BLKMOV function, its function value is transferred to the function 
value of the FC so that this is provided with the error information of the BLAKMOV 
function. 


The “variable” ANY pointer can be changed as desired. For example, the operand 
area can be set such that the transfer is to or from the memory area. 


Note: If the ANY pointer present in the temporary local data points to a tag which is 
also located in the temporary local data of the calling block, V must be entered as 
the operand area since, from the viewpoint of the called block, this tag is in the tem- 
porary local data of the preceding block. 


4.6.4 “Variable” ANY pointer with SCL 


Temporary local data of the type ANY can save the address of an operand or of a 
global or block-local tag: 


var_any := %MW10; 

var_any := #Setpoint; 
var_any := "Data".Arrayl; 
var_any := NIL; 


You can also assign NIL, a pointer “to nothing”, as the default value to a temporary 
local tag with data type ANY. 
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4.6 Parameter types and pointers 


Declaration of input parameters 
in the declaration subsection 


Example: function (FC) for transfer of variable data areas 
Input 
SDB : INT //Source DB 


SST : INT //Source start address 


NOB : INT //Number of bytes 
DDB : INT //Destination DB 


DST : INT //Destination start address 


SANY : ANY //Pointer to source 
DANY : ANY //Pointer to destination 


Return 


Beet VALS AT 


Input. 


Declaration of pointer tags used in 
the declaration subsection Temp. 


Declaration of the function value 


//Pointer for the source area 


W#16#1002 

SLWO 

#NOB 

SLW2 

#SDB 

SLW4 

#SST 

S 

DW#16#8400 0000 
SLD6 


The pointer is written with the 
source data area. 


In the example, the pointer 
address is assumed to be known: 
It commences at byte 0 in the 
temporary local data, and is 
therefore the address of the 
#SANY tag. 


//Pointer for the destination area 


The pointer is written with the 


LAR1 P##DANY destination data area. 

b WH16#1002 In the example, the pointer 

7 LW[AR1,P#0.0] address is assumed to be 

5 ae unknown and is first loaded 

into address register AR1. 

x PUN Addressing of the components 

4 DDB of the #DANY tag is then carried 

sty LW[AR1, P#4.0] out via address register AR1. 

L DST 

Sup 8 

OD DW#16#8400 0000 

ae LD[AR1, P#6.0] 

CALL BLKMOV Application of ANY tag as actual 
ANY parameter for the system function 
SRCBLK := #SANY BLKMOV. 

RET VAL := #RET VAL 
DSTBL = #DANY 


Fig. 4.24 Example of a “variable” ANY pointer with STL 
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You can directly process the individual components of an ANY pointer with SCL, for 
example the data block number or the operand ID, by overlaying a data type (see 
section “Overlaying tags (data type views with SCL)” on page 120). 


Example: In a function (FC) with the name Copy, two ANY pointers #SANY and 
#DANY are put together from individual block parameters (Fig. 4.25). 


Example: Variable ANY pointer with SCL 


Input //Declaration of block parameters 


SDE NE hE //Source data block 
Ssar g) ENTE //Source start address 
NOB : INT //Number of bytes 
DiI, = SIN //Destination data block 
Die SION //Destination start address 
Temp //Pointer to temporary local data 
SANY : ANY //Source pointer 
SPointer AT SANY : STRUCT //Overlaying with components 
Type : WORD 
Quantity S ION 
DBNo &  JONPIE 
Area : DWORD 
DANY : ANY //Destination pointer 
DPointer AT DANY : STRUCT //Overlaying with components 
Type : WORD 
Quantity g INE 
DBNo ey 
Area : DWORD 
Return 
#Copy SIGN //Function value 


//Compile source pointers 
SPointer.Type := W#16#1002; 
SPointer.Number := #NOB; 
SPointer.DBNo := # 
S 


SPointer.Area = L(IN := #SST , N := 3) OR DW#16#8400 0000; 


//Compile destination pointers 
DPointer.Type := W#16#1002; 

DPointer.Number := #NOB; 

DPointer.DBNo = # 
DPointer.Area 2= S 


L(IN := #DST , N := 3) OR DW#16#8400 0000; 


//Copy with BLKMOV 


Copy := BLKMOV ( //The block has the name 
SRCBLK := #SANY, //"“Copy". The function value 
DSTBLK := #DANY); //is the error information 


//from BLKMOV. 


Fig. 4.25 Example of a “variable” ANY pointer with SCL 
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4.8 Start information 


4.7 PLC data types 


A PLC data type is one with its own name. It is structured as the STRUCT data type, 
i.e. it consists of individual components, usually with different data types. You can 
use a PLC data type if you wish to assign a name to a data structure, for example 
because you frequently use the data structure in your program. A PLC data type is 
valid throughout the CPU (global). 


Programming a PLC data type 


All PLC data types are combined in the project tree under a PLC station in the 
PLC data types folder. To create a PLC data type, double-click on Add new data type 
in the PLC data types folder. Enter the individual components of the PLC data type 
in sequence in the declaration table with name, data type, default value, and com- 
ment. 


You can change the standard name User data type_n, where n is the consecutive 
number: Select the PLC data type in the project tree with the right mouse button, 
select the Properties command from the shortcut menu, and enter the new name 
under General. The name must not already be assigned to a PLC tag, a user constant, 
or a block. The operand ID is UDT (user-defined data type); the number is assigned 
by the program editor. 


Using a PLC data type 


A PLC data type can be assigned to any tag which is present in a global data block 
or in the interface of a logic block. The default setting for the PLC data type can be 
changed. You then address the individual components of the tag using 
#tag_name.comp_name. 


With a PLC data type as the basis, you can also generate a data block: In the project 
tree, double-click on Add new block in the Program blocks folder. Click on the 
Data block button in the Add new block window, and select the PLC data type from 
the Type drop-down list. The data structure of this type data block is then defined 
by the PLC data type and can no longer be changed. The default setting is imported 
by the PLC data type and can be changed. 


4.8 Start information 


When an organization block is called, the CPU's operating system transfers start in- 
formation in the temporary local data. The start information can only be directly 
scanned in the program of the organization block. The system block RD_SINFO also 
permits access to the start information from the blocks called in the organization 
block. 


The program editor automatically configures the start information when adding an 
organization block to the user program. The names and comments are in English, 
but can be adapted according to your requirements. 
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4 Tags, addressing, and data types 


Table 4.15 Structure of the start information 


Byte Data type Structure element | Meaning, remark 
) BYTE EV_CLASS Bits O to 3: Event detection 
Bits 4 to 7: Event class 
1 BYTE EV_NUM Event number 
2 BYTE PRIORITY Priority class, number of execution level 
3 BYTE NUM OB number 
4 BYTE TYP2_3 Data ID 2_3: identifies the information entered in ZI2_3 
5 BYTE TYP_1 Data ID 1: identifies the information entered in ZI1 
6207 WORD Zi1 Additional information 1 
S240 DWORD ZI2_3 Additional information 2_3 
12...19 | DATE_AND_TIME | Event time Beginning of event 


This start information is 20 bytes long for every organizational block and practical- 
ly identical. The “standard structure” of the start information shown in Table 4.15 
can be found as a basic framework in all organization blocks. Deviating assign- 
ments for individual organization blocks are described in Chapters 5.4 “Startup 
program” on page 171, 5.5 “Main program” on page 177, 5.6 “Interrupt processing” 
on page 196 and 5.7 “Error handling” on page 213. 
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5.1 Operating states of the CPU 


5 Program execution 


5.1 Operating states of the CPU 


A CPU 400 recognizes the following operating states: 

Deenergized, when the power supply is switched off 

STOP, when the user program is not being executed 

STARTUP, when the startup program is being executed 

RUN, when the main program and the interrupt routine are being executed 


HOLD, when a user program with breakpoints is being tested 


Faulty, if an internal error prevents further execution 


Fig. 5.1 illustrates the operating state transitions: After switching on (), the CPU is 
in the STOP operating state. If the mode switch on the front panel of the CPU is at 
RUN, the CPU changes to the STARTUP operating state @ and then to the RUN oper- 
ating state @). If a “serious” error occurs during execution in STARTUP or RUN, or 
if you set the mode switch to STOP, the CPU returns to the STOP operating state @) 


©. 


In the HOLD operating state, you can test the user program with breakpoints in sin- 
gle step mode. You can access this operating state either from RUN or STARTUP and 
return to the original mode when you exit testing © (@. You can also switch the CPU 
immediately to STOP from the HOLD operating state @). 


Operating states of a CPU 400 


—_@)—»> 
STARTUP <——@)—— 
+—_®— 
Switching on | ® t 
O— STOP RUN 
—_—_> 
+—_@®— HOLD © 
+ 
~¢—____—® 


Fig. 5.1 Operating states and operating state transitions of a CPU 400 
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5 Program execution 


The STOP operating state has the highest priority, followed by HOLD, STARTUP, and 
RUN with descending priority. For example, if a stop request comes from the pro- 
gramming device while the mode switch is at RUN, the CPU switches to the STOP op- 
erating state. 


5.1.1 STOP operating state 

The STOP operating state is reached 

when the CPU is switched on, 

when changing the mode switch from RUN to STOP, 
if a “serious” error occurs during program execution, 


if the STP system block is executed, and 


following a request from a communication function (stop request from pro- 
gramming device or by communication blocks of a different CPU). 


The CPU enters the cause of the STOP operating state into the diagnostic buffer. In 
this operating state you can also read out the CPU information using a program- 
ming device in order to find the reason for the stop. 


The user program is not executed in the STOP operating state. The CPU takes over 
the device settings - either the values you have set with the hardware configuration 
when parameterizing the CPU, or the standard settings - and sets the connected 
modules to the parameterized initial state. 


In the STOP operating state, the CPU can execute passive one-way communication 
functions. The real-time clock is running. 


You can parameterize the CPU in the STOP operating state, for example set the MPI 
address, transfer or modify the user program, and you can also carry out amemory 
reset for the CPU. 


Disabling of output modules 


All output modules are disabled when in the STOP, HOLD, and STARTUP operating 
states (OD or BASP signal, output disable or disable command output). Disabled 
output modules output a zero signal or - if configured accordingly — the substitute 
value. 


Although writing to the modules influences the signal memories on them, it does 
not switch the signal states “to the outside” to the module terminals. The output 
modules are only enabled when the RUN operating state is reached. 


In the STOP operating state, you can cancel disabling of the output modules for 
testing purposes (see Chapter 15.5.8 “Enable peripheral outputs” on page 627). 
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5.1 Operating states of the CPU 


5.1.2 STARTUP operating state 


The STARTUP is executed when the CPU changes from the STOP operating state to 
the RUN operating state. In the STARTUP operating state, the CPU initializes itself 
and the modules controlled by it. 


In the STARTUP operating state, the CPU updates the SIMATIC timer functions, the 
clock memories, the runtime meters and the real-time clock, and processes the user 
program in a startup organization block. 


No interrupt events — except errors — are processed during execution of the startup 
program. Interrupts occurring during the startup are executed after the startup but 
before the main program. 


Execution of a start-up routine can be canceled, e.g. by repositioning the mode 
switch or by a power supply failure. The aborted start-up routine is then executed 
from the beginning when the CPU is switched on. 


ACPU 400 has various types of start-ups: cold restart, warm restart, and hot restart. 


Cold restart 


With a cold restart, the CPU deletes the process image input and initializes the pro- 
cess image output and the peripheral outputs, i.e. the outputs and the peripheral 
outputs are reset or retain their last value depending on the parameterization (Fig. 
5.2). This is followed by disabling of the peripheral outputs by the OD or BASP sig- 
nal (output disable or disable command output). 


The CPU deletes all bit memories, SIMATIC timers, and SIMATIC counters (includ- 
ing the retentive ones), and sets the data operands to the start values from the load 
memory. The user program in the load memory (on a FLASH memory card) is load- 
ed into the work memory; the data blocks that were created in the work memory for 
each system block are lost in the process. 


The modules are parameterized as was defined by the hardware configuration. 


If the startup organization block OB 102 is present, it is called once (see Chapter 5.4 
“Startup program” on page 171). The peripheral inputs can be accessed directly 
during the startup program, and the outputs and peripheral outputs can be con- 
trolled. However, the signal states at the output terminals are not yet changed be- 
cause the peripheral outputs are still disabled. 


The process image input is updated following execution of the startup program, 
and the process image output is transferred to the I/O. Disabling of the peripheral 
outputs is then canceled. Following a cold restart, execution of the main program 
always commences at the beginning. 


A manual cold restart is triggered by a programming device or by a communication 
function from another CPU; the mode switch must be set to RUN. A manual cold re- 
start can always be triggered, except if the CPU requests a memory reset. 
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5 Program execution 


CPU 400 activities in STARTUP and RUN modes 
STARTUP 


Restart/warm restart 


Hot restart 


Permissible time yes 


of interruption 
exceeded | 
N° Restartiwarm restart 
parameterized 
i 


Cold restart 
parameterized 


yes 


Output modules Output modules 
are disabled are disabled 


I l 
Assign module Reset process image 


parameters input and output 
I l 
OB 101 Reset 
Hot restart peripheral outputs 
| l 
OB 1 Reset 


Remaining cycle non-retentive data 


I I 
Assign module 


Parameterizable: 
parameters 
Reset process output | 
image and 
OB 100 
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Y 
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of interruption 
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Cold restart 


Output modules 
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I 
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input and output 
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I 
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Cold restart 


Update process 
output image 
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Main program 
I 
Transfer process 
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Fig. 5.2 CPU activities in the STARTUP and RUN operating states 
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5.1 Operating states of the CPU 


An automatic cold restart is triggered by switching on the power supply. The auto- 
matic cold restart is carried out if 


> the CPU was not in STOP mode when the voltage was switched off, the mode 
switch is set to RUN and the start-up type cold restart has been parameterized in 
the CPU properties as “Startup after POWER ON” or 


> the CPU was interrupted during a cold restart by a power failure. 


Warm restart startup type 


With a warm restart, the CPU deletes the process image input and initializes the 
process image output and the peripheral outputs, i.e. the outputs and the periph- 
eral outputs are reset or retain their last value depending on the parameterization 
(Fig. 5.2 on page 146). This is followed by disabling of the peripheral outputs by the 
OD or BASP signal (output disable or disable command output). 


If the backup voltage is available, the CPU deletes the non-retentive bit memories, 
SIMATIC timers, and SIMATIC counters, and sets the non-retentive data operands to 
the start values from the load memory. The operands set as retentive are retained. 
The current program and the retentive data in the work memory are retained, as 
are the data blocks generated per system block. 


If the backup voltage is not present during a restart, the CPU performs the same ac- 
tions as for a cold restart. 


The modules are parameterized as was defined by the hardware configuration. 


If the startup organization block OB 100 is present, it is called once (see Chapter 5.4 
“Startup program” on page 171). The peripheral inputs can be accessed directly 
during the startup program, and the outputs and peripheral outputs can be 
controlled. However, the signal states at the output terminals are not yet changed 
because the peripheral outputs are still disabled. 


The process image input is updated following execution of the startup program, 
and the process image output is transferred to the I/O. Disabling of the peripheral 
outputs is then canceled. Following a warm restart, execution of the main program 
always commences at the beginning. 

A manual warm restart is triggered 


> by the mode switch on the CPU on a transition from STOP to RUN, or 


> by operator input on the programming device or a communication function 
from another CPU; the mode switch must be at RUN for this. 


A manual warm restart can always be triggered, except if the CPU requests a mem- 
ory reset. 
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5 Program execution 


An automatic warm restart is triggered by switching on the power supply. The auto- 
matic warm restart is carried out if 


> the CPU was not in STOP mode when the voltage was switched off, the mode 
switch is set to RUN and the start-up type restart (warm restart) has been param- 
eterized in the CPU properties as “Startup after POWER ON” or 


> the CPU is interrupted during a warm restart by a power failure. 


Hot restart 


In the event of a STOP or power failure, the CPU stores all interruption events and 
the internal CPU registers which apply to processing the user program. During a 
hot restart, it can then continue processing at the point in the program at which it 
was interrupted. This can be the main program or also an interrupt handler or error 
program. All (“old”) interruption events have been stored and are processed. 


A hot restart is only carried out if the backup voltage was present during the entire 
interruption and if the user program was not changed in STOP, e.g. by the changing 
of a block. 


During a hot restart, the CPU disables the output modules and parameterizes all of 
the modules as was configured in the hardware configuration. After this, the orga- 
nization block OB 101 (if available) is processed, followed by the “remaining cycle” 
(Fig. 5.2 on page 146). 


The “remaining cycle” from the point in the program at which the CPU continues 
after a hot restart up to the end of the main program is regarded as startup. No 
(new) interrupts are processed. 


After the “remaining cycle” the process image output is output and then deleted. If 
it is set in the CPU properties, the peripheral outputs (on the modules) are now also 
deleted. The hot restart ends with the updating of the process image input. 


By setting the CPU parameters, you can specify the interruption duration after 
which the CPU may still perform a hot restart (100 ms to 1 hour). If the interruption 
takes longer, only a cold restart or a warm restart is permitted. The duration of the 
interruption is the time from exiting the RUN state (STOP or power off) until the re- 
turn to the RUN state (after the processing of OB 101 and the remaining cycle). 


A manual hot restart is triggered by operator input on the programming device or 
a communication function from another CPU; the mode switch must be at RUN for 
this. Amanual hot restart is only possible if the restart inhibit is removed in the CPU 
properties. The cause of the STOP state must have been manually introduced, ei- 
ther by the mode switch, by operator input on the programming device, or by a 
communication function from another CPU; only then can a manual warm restart 
be carried out from STOP. 


An automatic hot restart is triggered by switching on the power supply. The auto- 
matic hot restart is carried out if the CPU was not in STOP mode when the voltage 
was switched off, the mode switch is set to RUN and the start-up type hot restart has 
been parameterized in the CPU properties as “Startup after POWER ON”. 
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5.1 Operating states of the CPU 


5.1.3 RUN operating state 


The RUN operating state is reached from STARTUP operating state. In the RUN op- 
erating state, the user program is executed and the PLC station controls the ma- 
chine or process. 


The following activities are executed cyclically by the CPU (see also Fig. 5.2): 


> Transmission of the process image output to the output modules 
> Updating of the process image input 


> Execution of the main program, including interrupt and error programs 


The main program is present in organization block OB 1 and the blocks called 
within it. 
In the RUN operating state, the CPU has unlimited communication capability. All 


functions provided by the operating system, e.g. time-of-day and runtime meter, 
are in operation. 


Further information on execution of the user program in the RUN operating state 
can be found in Chapter 5.5 “Main program” on page 177 (including process imag- 
es, cycle time, response time, time-of-day), in Chapter 5.6 “Interrupt processing” on 
page 196 (time-delay interrupts, cyclic interrupts, and hardware interrupts), and in 
Chapter 5.7 “Error handling” on page 213 (including OB 82 diagnostics interrupt 
and OB 80 time error). 


5.1.4 HOLD operating state 


The CPU enters the HOLD operating state if you test the program with breakpoints 
in single-step mode. The STOP LED is then lit, and the RUN LED flashes. 


The output modules are disabled when in the HOLD operating state, and therefore 
a zero signal or - if configured accordingly - the parameterized substitute value is 
output. 


All time procedures are stopped by the operating system when at HOLD. This refers, 
for example, to the execution of SIMATIC timer functions, clock memories, runtime 
meters, cycle time monitoring, processing of cyclic and time-delay interrupts. Ex- 
ception: The real-time clock continues as usual. 


With each progression by one statement in test mode, the times for the duration of 
the single step continue a little, and thus simulate a time response based on the 
“normal” program execution. 


In the HOLD operating state, the CPU has passive communication capability, i.e. it 
can participate in one-way data exchange, for example. 


5.1.5 Reset CPU memory 


A memory reset returns the CPU to its “initial state”. The CPU deletes the complete 
user program present in the work memory and in the RAM load memory and all op- 
erands, independent of the retentivity setting. 
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5 Program execution 


The CPU resets the parameters of all modules - including its own - to the standard 
settings. The MPI parameters of the first interface are an exception. These are not 
changed, and therefore a CPU for which a memory reset has been carried out 
remains addressable on the MPI bus. The diagnostic buffer, the real-time clock, and 
the runtime meters are not reset either. 


If a FLASH memory card with the user program is inserted, the CPU parameterizes 
the modules with the configuration data in the load memory and transfers the parts 
of the user program that are relevant to execution from the load memory to the 
work memory. 


There are two options for a memory reset of the CPU: using a connected program- 
ming device (see Chapter 15.4.5 “Online tools” on page 611) or using the mode 
switch on the front side. 


To perform a memory reset using the mode switch, move the switch to the STOP po- 
sition. The STOP LED lights up. Then hold the switch in the MRES position for at 
least three seconds. During this procedure, the STOP LED goes out for a second, 
then illuminates for a second, goes out again for a second, and then illuminates 
continuously. Now move the switch to the STOP position, then to the MRES position 
within three seconds, and then back to the STOP position again. While the memory 
reset is being performed, the STOP LED will flash for at least three seconds at 2 Hz 
and then remain lit. 


If the CPU requests a memory reset by slowly flashing the STOP LED, move the 
mode switch to the MRES position and then to the STOP position. While the memory 
reset is being performed, the STOP LED will flash for at least three seconds at 2 Hz 
and then remain lit. 


5.1.6 Restoring the factory settings 


You can restore the factory settings with a “Reset to factory settings”. Proceed as 
follows: 


> Switch off the power supply and remove the memory card. 
> Hold the mode switch in the MRES position and switch the power supply on 
again. 


> Once the status LEDs INTF, FORCE, RUN, and STOP flash slowly, release the 
mode switch, set it to MRES again within 3 s, and hold it in this position. 
All LEDs light up after approximately 4 s. 


> Wait until only the INTF LED flashes. During this period (approx. 5 s), you can 
abort the reset procedure by releasing the mode switch. 


> Once the SF LED shows a continuous light, release the mode switch. 


The CPU starts up and all status LEDs light up. It executes a memory reset, then sets 
the MPI address to 2 and the MPI baud rate to 187.5 Khbit/s. As well as the memory 
reset, the real-time clock is set to the start date (DT#1994-01-01-00:00:00.000) and 
the runtime meters and diagnostic buffer are deleted. 
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5.2 Creating a user program 


Finally, the CPU enters the “Reset to factory settings” event into the diagnostic 
buffer, and goes to the STOP operating state. 


5.1.7 Retentive behavior of operands 


Amemory area is retentive if its contents are retained even when the power supply 
is switched off, as well as on a transition from STOP to RUN following power-up. Re- 
tentive behavior is only possible if a back-up battery is installed and in working or- 
der. Hot restart or warm restart must be set as startup type. 


Retentive operand areas can be bit memories, SIMATIC timers, SIMATIC counters, 
and data blocks. The maximum length of the retentive areas is CPU-specific. You de- 
fine the number of retentive memory bytes, timers, and counters with the hard- 
ware configuration in the CPU properties under Retentivity. 


You define the retentivity of a data block —- independent of its type — in the declara- 
tion table in the Retentivity column. Only the complete data block can be set reten- 
tive or non-retentive. 


5.2 Creating a user program 


5.2.1 Program draft 


You define the structure of the user program during the draft phase by adaptation 
to technological and functional conditions; this is important for program creation, 
testing, and startup. In order to achieve effective programming, it is therefore nec- 
essary to pay particular attention to the program structure. 


Analysis of a complex automation task means division of it into smaller tasks or 
functions based on the structure of the process to be controlled. You define the 
individual tasks by determining the function and then defining the interface sig- 
nals to the process or to other individual tasks. You can adopt this structuring of 
individual tasks in your program. This means that the structure of your program 
corresponds to the structure of the automation task. 


A structured user program is easier to configure and program section by section, 
and means that more than one person can carry out the work in the case of very 
large user programs. Last but not least, program testing, servicing, and mainte- 
nance are simplified by this division. 


With a linear program structure, the entire user program is present in one single 
block - a good solution for small programs. The individual control functions are 
program parts within this block, and are executed in succession. A block can be 
divided into so-called networks (not with SCL), each of which has part of the block 
program. STEP 7 numbers all networks in succession. During editing and testing, 
you can directly reference each network using its number. 
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5 Program execution 


The networks are executed in the order of their numbering, but can also be 
bypassed depending on conditions. The program can be tested in sections using 
jump instructions temporarily inserted during commissioning. 


A modular program structure is used if the task is very extensive, if you wish to 
repeatedly use program functions, or if complex tasks exist. Structuring means 
dividing the program into sections - blocks - with self-contained functions or a 
functional correlation, and exchanging as few signals as possible with other blocks. 
If you assign a specific (technological) function to each program section, manage- 
able blocks are achieved with simple interfaces to other blocks. 


In Fig. 5.3, a simple example is used to compare linear program structures with 
modular program structures. With the linear program structure, the individual con- 
trol functions are written in succession into a block. In the modular program struc- 
ture, each control function is present in a block which is called by a “higher” block. 
Further blocks can be called in turn in the called block. 


Blocks can also be used repeatedly. Let us assume in the example that the control 
of motors 1 to 3 has the same function, only the input and output signals and the 
control operations are different. A Motor block can then be called three times 
with different signals (parameters) and control the motors independent of one 
another. 


Practice-oriented program organization 


In the block at the highest position in the call hierarchy (in the main program), you 
should call the blocks located “underneath” in such a manner that you achieve 
rough structuring of your program. Program structuring is possible according to 
technological or functional aspects. 


The following explanations can only present a rough and very general view which 
can provide a beginner with food for thought with regards to program structuring 
and ideas for realization of his control task. Advanced programmers usually have 
enough experience to allow them to find a program structure appropriate to the 
specific control task. 


Technological program structuring is strongly based on the structure of the 
plant to be controlled. The individual parts of the plant or the process to be 
controlled correspond to the individual program sections. Subordinate to this 
rough structuring is the scanning of limit switches and HMI devices and the control 
of final controlling elements and display units (specific to each plant unit). Signal 
exchange between the individual plant units (or better: program sections) takes 
place by means of global tags. 


Functional program structuring is based on the control function to be executed. 
This type of program structuring does not initially take into account the structure 
of the plant to be controlled. The division of the plant only becomes visible in the 
subordinate blocks if the control function achieved using the rough structuring is 
divided further. 
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5.2 Creating a user program 


Linear and modular program structures 
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Fig. 5.3 Comparison between linear and modular program structures 


In practice, mixed forms of the two structuring concepts are usually present. Fig. 
5.4 shows an example: The operating mode program and the data processing pro- 
gram reflect a plant-independent division of functions. The program sections Feed 
1, Feed 2, Process, and Remove base their technological structuring on the plant 
units to be controlled. 


The example also shows the use of different types of block (further information on 
the types of block can be found in Chapter 5.2.3 “Block types” on page 156). The or- 
ganization block OB 1 contains the main program; the blocks for the operating 
modes, for the individual plant units, and for data processing are called in it. These 
blocks are function blocks (FB) with an instance data block (DB) as the data memo- 
ry. Feed 1 and Feed 2 have an identical structure; FB 20 is used to control a feeder 
unit, in the case of Feed 1 with DB 20 as the instance data block, and in the case of 
Feed 2 with DB 21. 
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5 Program execution 


Example of program organization 


OB1 Main program 
L—— B10 DB10 Operating modes 
-}——_ FB20 DB 20 Feed 1 


FC20_—Interlocks 
FB101_ ~=Belt control 1 
FB101_— Belt control 2 


etc. 


FB19 ~=Data acquisition 


-—— B20 DB21 Feed 2 
++—_ FB30 DB30 ~=©Process 
#—_ 


FB 40 DB40 Remove 


[-+—— _FB50 DB50_ ~=— Datta processing 


PrsenheahnrscescSakecng DB59_ _—+Delivery data 
FC51 Data preparation 


=} FB511 DB 51 Communication 


USEND 


URCV 


Fig. 5.4 Example of program organization 


In the Feed controller, the function FC 20 processes the interlocks; it scans inputs or 
bit memories, and controls the local data of FB 20. Function block FB 101 contains 
a conveyor belt control; it is called once per conveyor belt. The call is carried out as 
a local instance so that its local data is present in the instance data block DB 20. The 
same applies to the data acquisition FB 29. 


Data processing FB 50 with DB 50 processes the data acquired with FB 29 (and other 
blocks) which is present in the global data block DB 60. Function FC 51 prepares this 
data for transmission. Transmission is controlled by FB 51 (with DB 51 as the 
instance data block), in which the USEND and URCV are called for communication 
with another station. The system blocks store their instance data in the “higher-lev- 
el” DB 51 in this case as well. 


Block nesting depth 


A further block can be called within a block, and then another one in this, etc. The 
number of such “horizontal” call levels, the nesting depth, is limited. In Fig. 5.4, for 
example, block FB 20 is called in block OB 1 (nesting depth 1), and then block FC 20 
in FB 20. This corresponds to a nesting depth of 3. 
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5.2 Creating a user program 


The maximum nesting depth is 24 in the startup program, main program, and an 
interrupt routine; in an error program 1 or 2 in addition (with CPU 416 and CPU 
417). If more blocks are called in the “horizontal” level, the CPU generates a pro- 
gram execution error. 


Blocks which are called in succession (linear, “vertical”) do not generate a new call 
level and therefore do not affect the nesting depth. The opening of a data block does 
not generate a new call level either. 


5.2.2 Program execution 


The complete program of a CPU comprises the operating system and the user pro- 
gram (control program). 


The operating system is the totality of all statements and declarations of internal op- 
erating functions (e.g. saving of data in event of power failure, activation of priority 
classes etc.). The operating system is a fixed part of the CPU which you cannot mod- 
ify. However, you can reload the operating system from a FLASH memory card, e.g. 
for a program update. 


The user program is the totality of all statements and declarations programmed by 
you for signal processing by means of which the plant (process) to be controlled is 
influenced in accordance with the control task. 


The user program consists of program sections which are executed by the CPU for 
specific events. These events can be, for example, the starting up of the automation 
system, an interrupt, or detection of a program error (Fig. 5.5). The programs 
assigned to the events are divided into priority classes which define the sequence 
of program execution if several events occur simultaneously and thus the interrupt 
capability hierarchy. 


The main program, which is executed cyclically by the CPU, has the lowest execu- 
tion priority. All other events can interrupt the main program following each state- 
ment; the CPU then executes the associated interrupt or error program and sub- 
sequently returns to execution of the main program. 


A specific organization block (OB) is assigned to each event. The organization 
blocks represent the event classes in the user program. If an event occurs, the CPU 
calls the associated organization block. An organization block is part of the user 
program which you can program yourself. The quantity of organization blocks, to- 
gether with their numbers and assignments to events, are fixed for a CPU 400. Each 
controller type has a certain range of organization blocks. 


Program execution commences in the CPU with the startup program. A startup 
can be triggered by switching on the power supply or by an operator input on a con- 
nected programming device. The start-up routine is optional. If you would like to 
create a startup program for a CPU 400, use the organization block OB 100 (warm 
restart), OB 101 (hot restart), or OB 102 (cold restart), depending on the type of 
start-up. In a start-up organization block additional logic blocks can be called up. 
Following execution of the start-up routine, the CPU commences with execution of 
the main program. 
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Program execution modes of the user program 


Operating system User program 


rat STARTUP mode 
Switching on 


eee 


Pores 


RUN mode 
Cycle start 


Main program 


Startup program 


<Interrupt> }§=-=———> Interruption Interrupt program 


<Error> | Le. a Interruption 


eae 


Fig. 5.5 Program execution modes of a SIMATIC user program 


Error program 


ee 


The main program is present as standard in organization block OB 1 which is 
always executed by the CPU. The start of the program is identical to the first state- 
ment in OB 1. Further code blocks can be called in the OB 1. The main program com- 
prises the program in OB 1 and the programs in all blocks called in OB 1. 


Following execution of the main program, the CPU branches to the operating 
system and, following execution of various operating system functions (e.g. update 
process images), it calls OB 1 again. 


Events that can interrupt the main program are interrupts and errors. Interrupts 
have their origin in the controlled plant (hardware interrupts), in the CPU 
(time-delay interrupts and cyclic interrupts), or on the modules (DPV1 interrupts, 
for example). 


A distinction is made between asynchronous and synchronous errors. An asynchro- 
nous error is one which is independent of the program execution, such as a power 
supply failure in an expansion unit. A synchronous error is one caused by the 
program execution, for example the addressing of a non-existent operand or an 
error during conversion of a data type. 


5.2.3 Block types 
You can divide your program into individual sections as required. These program 


parts are called “blocks”. A block is a part of the user program that is defined by its 
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function, structure or application. Each block should feature a technological or 
functional framework. 


User blocks 


You can select different types of block depending on the application: 


> Organization blocks OB 
The organization blocks represent the interface between operating system and 
user program. The CPU's operating system calls the organization blocks when 
certain events occur. The organization blocks have a fixed number corresponding 
to the call event, for example the main program is in organization block OB 1. The 
organization blocks provide so-called start information when called, and this can 
be evaluated in the user program. 


> Function blocks FB 
A function block is part of the user program whose call can be programmed 
using block parameters. A function block has a tag memory which is located ina 
data block - the instance data block. If a function block is called as a single 
instance, a separate instance data block is assigned to the call. When called as a 
local instance, the data is stored in the instance data block of the calling function 
block. 


> Functions FC 
The blocks referred to as “functions” are used to program frequently recurring 
automation functions. The calls can be parameterized. Functions do not store 
information and have no assigned data block. 


> Data blocks DB 
Data blocks contain data of the user program. A data block can be generated as a 
global data block, as an instance data block, or as a type data block. With a global 
data block, you program the data tags directly in the data block. With an instance 
data block, the programming of the assigned function block determines the data 
tags present in the data block. A type data block has the structure of a PLC data 


type. 


The number of organization blocks and their block numbers are defined by the 
operating system. The block numbers of the other types of block can be assigned as 
desired within the permissible range. Note that the number range is larger than the 
number of permissible blocks. Blocks should preferably be symbolically addressed 
using aname. 


System blocks 


System blocks are components of the operating system. They can contain programs 
(system functions SFC or system function blocks SFB) or data (system data blocks 
SDB). System blocks make a number of important system functions accessible to 
you, for example manipulating the internal CPU clock or the communication func- 
tions. 
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You can call system functions and system function blocks, but you cannot modify 
them or program them yourself. The blocks themselves do not require space in the 
user memory; only the block call and the instance data blocks of the system func- 
tion blocks are in the user memory. 


You handle system functions in the user program exactly like functions (FC), and 
system function blocks exactly like function blocks (FB). 


System data blocks contain configuration data, for example module parameters. 
These blocks are generated and managed by STEP 7 itself. You can only read and 
write the contents of system data blocks in special cases, for example when 
“reparameterizing” modules using system blocks. 


Standard blocks 


In addition to the functions and function blocks you create yourself, off-the-shelf 
blocks are also available from Siemens. These so-called standard blocks can be pro- 
vided on a data storage medium or are delivered together with STEP 7, for 
example as extended statements or in the global libraries. You cannot view or edit 
the range of standard blocks. Standard blocks behave like user blocks: They require 
space in the user memory. 


Standard blocks also share the number range with the user blocks. If a standard 
block is added to the user program by means of an extended statement, for example, 
the number of the standard block can no longer be occupied by a user block. If a user 
block is already present with the number of the standard block which you add to the 
user program, the number of the standard block is initially retained. The standard 
block is then assigned a different, unused number during the next compilation. 


5.2.4 Editing block properties 


To display and change the block properties, select the block in the project tree and 
then the Properties command in the shortcut menu. Fig. 5.6 shows as example for 
the block properties the sections General and Information of a function block. 


The General section contains the Name of the block. The block name must be 
unique within the program and must not already have been assigned to a PLC tag, 
a constant, a PLC data type, or another block. The name can contain letters, digits, 
and special characters (but not quotation marks). No distinction is made between up- 
per and lower case when checking the name. The block type is determined when cre- 
ating the block. The number is the block number within the block type. For blocks 
with a program, the programming language is: LAD, FBD, STL, SCL, or GRAPH, for 
data blocks DB. In the case of a function block with sequence control (GRAPH), you 
also set the programming language in the networks here (LAD or FBD). 


With data blocks, the designation DB together with the type of data block is present 
in the Type field: Global DB in the case of a global data block, Instance DB of 
<FB_name> in the case of an instance data block of the function block <FB_name>, 
and Data block derived from <Type_name> if the structure of the data block is based 
on the data type <Type_name>. 
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General 
Name: | BeltControl 
Type: |FB 
Number: [15 | 
Language: | LAD [+] 
Information 


Title: | Conveyor belt control 


Comment: | This block controls a conveyor belt with a single 
drive in one direction only, without overrun. 


Version: | 1.0 


Family: | Book400 
Author: | Berger 
User-defined ID: | CBV001 


Fig. 5.6 Block properties: General and Information tabs 


The Information section contains the Title and the Comment; these are identical to 
the block title and the block comment which you can enter when programming the 
block prior to the first network. The Version is entered using two two-digit numbers 
from 0 to 15: from 0.0 to 0.15, 1.0 to 15.15. Under Author you can enter the creator of 
the block. Under Family you can assign a common feature to a group of blocks, as is 
also the case with User-defined ID. The author, family, and block ID can each comprise 
up to 8 characters (without spaces). 


The time data in the Time stamps section indicates the date of creation of the block 
and the date of the last modification to the block, interface, and program. 


The Compilation section provides information on the processing status of the 
block, and - following compilation - on the scope of temporary local data and the 
memory requirements of the block in the load and work memories. 


The Protection section indicates the block protection. A block can be protected so 
that the program can no longer be read out (know-how protection). In the case of a 
protected block, Block is protected is present here. For more information, refer to 
section “Configuring know-how protection” on page 161. 


Attributes 


Table 5.1 lists the block attributes for code blocks with LAD, FBD or STL programs 
and for data blocks. The IEC check attribute is present for each code block. Addition- 
al attributes for compilation of SCL blocks are described in Chapter 6.5.2 “Compil- 
ing SCL blocks” on page 274. The attributes for compilation as well as the sequence 
properties for the GRAPH function block are described in Chapter 11.3.6 “Attributes 
of the GRAPH function block” on page 453. 
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Table 5.1 Block attributes 


Attribute For block Meaning with attribute activated 
IEC check OB, FB, FC A stricter test of the data types takes place. 
Multiple instance capability | FB The function block can be called in another function 


block as a local instance. 


Data block write-protected Global DB, The data of the data block cannot be overwritten by 

in device type DB means of a program during runtime. 

Only store in load memory Global DB, The data block is not transferred to the work memory; 
type DB it is only present in the load memory. 


The IEC check attribute indicates how strict the data type test is to be in the code 
block. With the attribute not activated, it is usually sufficient if the tags used have 
the data width required for execution of the function or statement; with the attri- 
bute activated, the data types of the tags must correspond to the required data types. 


The Multiple instance capability attribute is only present with function blocks. If the 
Multiple instance capability attribute is activated (this is the standard setting), you 
can call the block as a local instance in another function block. If the function block 
is generated via an external source file with the keyword CODE_VERSION1, the 
Multiple instance capability attribute can be activated or deactivated. The advantage 
of a “not capable of multi-instance” function block is - since address register AR2 is 
not used - the unlimited use of instance data for indirect addressing, which is only 
of significance with STL programming. 


Data block write-protected in device is an attribute only for global and type data 
blocks. It means that you can only read from this data block by means of a program. 
Overwriting of the data is prevented and an error message is generated. The write 
protection applies to the data relevant to execution (actual values) in the work 
memory; the data in the load memory (start values) can be overwritten even if the 
data block is provided with write protection. Write protection must not be confused 
with block protection: A data block with block protection can be read and written by 
the program; however, its data can no longer be viewed using a programming or 
monitoring device. The Data block write-protected in device attribute is switched off 
as standard, but this can be changed at any time using the program editor. The key- 
word for programming with a source file for switching on the write protection is 
READ ONLY. 


Global and type data blocks can be assigned the Only store in load memory attribute. 
Such types of data block are only present in the load memory, they are “not relevant 
to execution”. Since their data is not in the work memory, direct access is not possi- 
ble. Data in the load memory can be read for a CPU 400 with the system function 
BLKMOV. Data blocks with the Only store in load memory attribute are suitable for 
data which is only accessed rarely, e.g. recipes. This attribute is switched off as stan- 
dard and can be changed at any time using the program editor. The keyword for 
programming with a source file is UNLINKED. 


160 


5.2 Creating a user program 


The “Retentive” property with data blocks is not set using a block attribute but in 
the declaration table in the Retentivity column. The keyword for programming via a 
source file for non-retentive data blocks is NON_RETAIN. 


Configuring know-how protection 


With the know-how protection for a block you can prevent a program or its data 
from being read out or modified. A protected block is identified in the project nav- 
igation by a padlock icon. It is still possible to read the following from a block pro- 
vided with know-how protection: 


Vv 


Block properties 
> Parameters of the block interface 


> Program structure 


Vv 


Global tags (listed in the cross-reference list without specification of 
the position of use) 


The following actions are also possible: 


Modify name and number in the block properties (necessary for copying and 
pasting the block) 


Copy and paste block where the know-how protection is also copied 
Delete, compile, and download block 


Call block (FB or FC) in the program of another block 


Compare online and offline versions of the block (comparison only of 
non-protected data) 


To edit the know-how protection, select the block in the project tree under Program 
blocks, and then select Edit > Know-how protection in the main menu. To configure 
the know-how protection, click the Define button, enter a password, confirm the 
password, and close the dialog with OK. To change the password, click the Change 
button, enter the old and new passwords, confirm the new password, and close the 
dialog with OK. To cancel the know-how protection, deactivate the Do not show code 
(know-how protection) checkbox, enter the password, and close the dialog with OK. 


You can also apply the know-how protection to several blocks simultaneously if 
these have the same password. 


Note: If the password is lost, no further access to the block is possible. You can only 
cancel the know-how protection of a block in its offline version. If you download a 
compiled block to the CPU, the recovery information is lost. A protected block which 
you have uploaded from the CPU (thus overwriting the offline version!) cannot be 
opened, not even with the correct password. 
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5.2.5 Block interface 


Components of the block interface 


The block interface contains the declarations of the local tags that are used solely 
within the block. These are the block parameters and the temporary and static local 
data. The block interface is shown as a table in the top part of the working window 
and contains - depending on the block type - the sections shown in Table 5.2. 


Table 5.2 Declaration sections in the block interface 


Section Type, function, and data types Included in 


Input Input parameters FC and FB 
may only be read in the program of the block, 
Elementary and complex data types, 

TIMER, COUNTER, BLOCK_xx, POINTER, ANY 
FB: STRING of adjustable length 
FC: STRING with standard length 254 


Output Output parameters FC and FB 
may only be written in the program of the block, 
Elementary and complex data types, 

FB: STRING of adjustable length 
FC: STRING with standard length 254, POINTER, ANY 


InOut In/out parameters FC and FB 
may be read and written in the program of the block, 
Elementary and complex data types, 

STRING with standard length 254, POINTER, ANY 


Temp Temporary local data FC, FB and OB 
may be read and written in the program of the block, 

are only valid during the current block processing 

Elementary and complex data types, STRING of adjustable length, BLOCK_xx, 
POINTER, ANY with special function 


Static Static local data FB 
may be read and written in the program of the block, 

is saved in the instance data block and remains valid even following block 
processing 

Elementary and complex data types, STRING of adjustable length 


Return Function value FC 
may only be written in the program of the block, 

is an output parameter with the return value of a function 

Elementary and complex data types, STRING of adjustable length, ANY, VOID 


Input parameters 


An input parameter transfers a value to the program in the block and may only be 
read. Input parameters are shown in the block call in the sequence of their declara- 
tion, with LAD and FBD on the left side of the call box and with STL and SCL at the 
start of the parameter list. 


An input parameter with data type STRING has an adjustable maximum length in a 
function block, and a fixed maximum length of 254 characters in a function. The da- 
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ta type TIMER can be used to transfer a SIMATIC timer function, and the data type 
COUNTER to transfer a SIMATIC counter function. 


Blocks can also be transferred at the interface: A function block with BLOCK_FB, a 
function with BLOCK_FC, and a data block with BLOCK_DB. The transferred code 
blocks must not have any parameters themselves. 


Output parameter 


An output parameter transfers a value to the calling block and may only be written. 
Output parameters are shown in the block call in the sequence of their declaration, 
with LAD and FBD on the right side of the call box and with STL and SCL following 
the input parameters in the parameter list. 


An output parameter with data type STRING has an adjustable maximum length in 
a function block, and a fixed maximum length of 254 characters in a function. 


Caution: Output parameters which cannot be assigned a default value must be written 
in the block during each block processing. This applies, for example, to all output 
parameters in the case of a function (FC) and thus also to the function value. 

Note: Set and reset statements do not execute an action if the result of the logic opera- 
tion = “0”, and therefore do not write to an output parameter! 


In/out parameter 


An in/out parameter transfers a value to the program in the block and can return it 
to the calling block, usually with a changed content. An in/out parameter can be 
read and written. In/out parameters are shown in the block call in the sequence of 
their declaration, with LAD and FBD on the left side of the call box under the input 
parameters and with STL and SCL at the end of the parameter list. 


An in/out parameter with data type STRING has a fixed maximum length of 254 
characters. 


5.2.6 Example of use of block parameters 


By means of block parameters you enable parameterization of the processing spec- 
ification (the block function) present in a block. 


The example shows an adder with three summands which can be used repeatedly 
in the user program with different tags. The tags are transferred as block parame- 
ters - in our example, three input parameters and one output parameter. Since the 
adder need not permanently save values internally, a function FC is suitable as the 
block type (Fig. 5.7). 


The values to be transferred are declared as input parameters in the Input section 
with name and data type, the calculated value as an output parameter in the Output 
section, also with name and data type. If the program is written in LAD or FBD in the 
block, another tag is required as intermediate memory. This is declared in the Temp 
section, since its value is not required outside the block. A tag for intermediate stor- 
age is not required with an STL or SCL program. 
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Program in the called block "Adder" 


Template Block interface 
input. |Nurber4 The block interface contains the 
Adder P Mm er a) LINE input and output parameters and 
INT Number_2| INT a temporary tag which is used 
Number 1 — Number_3] INT with LAD and FBD as an 
= intermediate memory in the 
Number_2. —— Output | Result INT program. This can be omitted 
Number_3 —— — Result} Temp |Sum INT with STL and SCL. 
Program 
Graphic representation (LAD, FBD) SCL 
ADD #Result := #Number_1 + # Number_2 + # Number_3; 
INT 
#Number_1— IN1 OUT — #Sum STL 
#Number_2 —= IN2 L  #Number_1 
ADD L  #Number_2 
INT + 
#Sum — IN1 OUT — #Result ni PNAMDEIE? 
#Number_3 — IN2 bi 
T  #Result 


In the block program, the block parameters are called formal parameters. They are used like tags 
which have the same data type. The number symbol (#) in front of the name identifies the formal 
parameters and the other tags in the interface definition as local tags. 


Graphic representation (LAD, FBD) 


Adder 
%MW30 —— Number_1 Result —— %MW40 


%MW32 —— Number_2 
%MW34 —— Number_3 


During the block call, the block parameters are 
supplied with tags which are referred to as 
actual parameters. 

The called block works with the values of the 
actual parameters. 


Call of block "Adder" 


SCL 
"Adder" ( Number_1 := %MW30, 
Number_2 := %MW32, 
Number_3 := %MW34, 
Result => %MW40); 
STL 
CALL "Adder" 


Number_1 := %MW30 
Number_2 := %MW32 
Number_3 := %MW34 


Result = %MW40 


Graphic representation (LAD, FBD) 


Executed program in the block "Adder" 


ADD 

INT 
%MW30 — IN1 OUT —— #Sum 
%MW32 —— IN2 

ADD 

INT 

#Sum — IN1 OUT —— %MW40 

%MW34 — IN2 


SCL 

%MW4O := %MW30 + %MW32 + %MW34; 
STL 

L  %MW30 

L %MW32 

+1 

L %MW34 

+1 

T %MW40 


Fig. 5.7 Block call with block parameters 
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The program in the block can be written in the language with which the block func- 
tion is best mapped, independent of the programming language with which the 
block is subsequently called. The block parameters used in the block program are 
called formal parameters. They are handled like tags which have the same data type. 


The “Adder” function can then be called repeatedly in the user program. Different 
values are transferred to the adder at the block parameters with each call. These 
values can be constants, operands, or tags; they are referred to as actual parame- 
ters. During runtime, the control processor replaces the formal parameters by the 
actual parameters. 


5.3 Calling blocks 


5.3.1 General information on calling of code blocks 


If blocks are to be processed, they must first be called in the program. The organi- 
zation blocks which are started by the operating system when certain events occur 
are an exception. 


With FBD and LAD, the call functions are boxes with an enable input EN and an 
enable output ENO. A conditional block call can be implemented using the enable 
input EN. The enable output ENO can be used to signal a malfunction determined 
in the block to the calling block. With SCL, the enable input EN and the enable 
output ENO are parameters which are implicitly present. With STL, this “EN/ENO 
mechanism” can be mapped using STL statements. 


A call function shows all block parameters which were declared when the block was 
created. If you subsequently change the block interface of the called block, you 
must update the changes in the block call otherwise the program editor will signal 
an “Interface conflict” (see Chapter 6.6.5 “Consistency check” on page 281). 


A prerequisite for calling a block is that it exists; at least its interface must be pro- 
grammed. You call a block by selecting it under Program blocks in the project tree 
and dragging it into the program of an opened block using the mouse. 


If you drag a block directly from a library into an opened block, it is copied into the 
Program blocks folder. If it is a system or standard block, it is saved in the 
Program blocks > System blocks > Program resources folder. 


5.3.2 Calling functions (FC) 


When calling a function, all block parameters must be supplied with actual oper- 
ands, i.e. you must connect operands or tags to all block inputs and outputs. You 
can supply EN and ENO as required with the graphic programming languages. 


Fig. 5.8 shows an example of calling a function (FC) in the various programming 
languages. The block parameter Result is configured as an output parameter; the 
function has no function value. 
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Calling a function (FC) in LAD, FBD, STL, and SCL 


LAD FBD 
C26 C26 
“Adder “Adder 
EN ENO EN 
<2??>— Number_1 Result — <??7> <???>—= Number_1 
<2??> — Number_2 <???> — Number_2 Result — <???> 
<2??>— Number3 <???>— Number_3. —ENO— 


STL 


1 CALL “Adder” $FC26 
2 Number_1 :=_ 
Number_2 :=_ 
4 Number_3 :=_ 
5 Result = 
6 
SCL 1 B"Adder" (Number_1:= int in, 


Number_2:=_int_in_, 
Number_3:=_int_in_, 
4 Result=>_int_out_); 


w Nh 


Fig. 5.8 Calling a function (FC) in the various programming languages 


Supplying the block parameters 


You can use tags from the inputs, outputs, and bit memories operand areas for all 
block parameters. Constants and peripheral inputs are only permissible for input 
parameters, peripheral outputs only for output parameters. When using data tags, 
you are strongly recommended to use complete addressing (“Data block”.Data tag”) 
since the programming interface does not indicate which data block has been 
currently opened by the program editor. 


The data type of the actual parameter must correspond to the data type of the block 
parameter. The data types must agree exactly if the IEC check attribute is activated 
in the calling block, otherwise matching widths of the data type or operand are usu- 
ally sufficient. 


On a block parameter with the data type TIMER, a SIMATIC timer function (T) is per- 
mitted as the actual parameter. On a block parameter with the data type COUNTER, 
a SIMATIC counter function (C) is permitted. 


Any maximum length of a current parameter is possible for a block parameter with 
data type STRING. Note that an actual parameter with data type STRING which has 
been declared in the temporary local data cannot be assigned a default value and 
therefore has any content. It must be provided with meaningful values before being 
used as an actual parameter. 


Tags with elementary data type and pointers (e.g. P#DB10.DBX20.5) are permissible 


on block parameters with parameter type POINTER. These can also be completely 
addressed data tags or components of an array or data structure. 
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Tags of all data types are approved for block parameters with parameter type ANY. 
The tags which must be connected to the block parameters or which are meaningful 
are defined by the programming within the called block. You can also specify a 
constant with the format of the ANY pointer “P#[Data block.]Operand Data type 
Quantity”, and thus define an absolutely addressed area. Supplying with temporary 
local data of data type ANY is handled separately (see Chapters 4.6.3 ““Variable” 
ANY pointer with STL’ on page 138 and 4.6.4 ““Variable” ANY pointer with SCL” on 
page 138). 


Using a function value of a function (FC) 


The function value of a function has no effect when declared with data type VOID. If 
the function value has a different data type, it is shown in LAD, FBD, and STL as the 
first output parameter and it is also handled like an output parameter. 


SCL handles a function with function value like a tag with the data type of the func- 
tion value. Fig. 5.9 shows an example: The function “Adder2” adds three numbers 
and returns the total as a function value with data type INT. The total can be directly 
processed further in an expression. 


Declaration of the function value in the "Adder2" function 


Block interface The block interface contains the three input parameters and the 


Input Number 4 INT function value as the result of the addition 
nee pel #Result := #Number_1 + #Number_2 + #Number_3; 
Number_2_| INT The declaration as function value has no effects for the program 
Number_3 INT in the "Adder2" block. The program could also have been created 
Return | Result INT using one of the programming languages LAD, FBD or STL. 


Call of the "Adder2" block in the SCL program 
SCL 
[Call within an expression 


#Tag_1 :="Adder2" (Number_1 := %MW30, Number_2 := %MW32, Number_3 := %MW34) + #Tag_2; 


The "Adder2" function can now be used in an expression in the programming language SCL. 
The function has the data type which was assigned to the function value in the RETURN declaration. 


Fig. 5.9 Use of the function value with SCL 


5.3.3 Calling function blocks (FB) 


When calling a function block, you are requested to specify the storage location of 
the instance data. This is the data with which the function block works internally: 
the block parameters and the static local data. 


Specify a data block if the call takes place in an organization block or a function. The 
call then takes place as a “single instance”, and the data block is the instance data 
block for this call. If you call the function block as a single instance for a second 
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time, enter a different data block as the instance data block. This then contains the 
data for the second call. Assign a separate data block to each call of a function block 
as single instance. 


Fig. 5.10 shows an example of calling a function block (FB) as a single instance in 
the various programming languages. The function block in the example is named 
“Motor”; the instance data block assigned to the call is named “Motor_DB”. 


Calling a function block as single instance 


LAD FBD 
‘DB26 °%DB26 
“Motor_DB* "Motor DB" 
B26 B26 
“Motor” "Motor" 
EN ENO __—EN 
false — Switch-on Motor =... false — Switch-on Motor — ... 
false — Switch-off Display -... false — Switch-off Display — ... 
false — Fault false — Fault ENO — 
STL - 
1 CALL “Motor”, "Motor_DB" $FB26, %DB26 
2 Switch-on := 
3 Switch-off := 
: Fault = 
5 Motor = 
6 Display = 
SCL 7 A"Motor_DB". "Motor" (Switch-on:=_bool_in , 
Switch-off:=_bool_in, 
9 Fault:=_bool_in, 
10 "Motor"=>_bool_out_, 
11 Display=>_bool_out_); 
12 


Fig. 5.10 Calling a function block as single instance 


When calling a function block with “multi-instance capability”, you can choose the 
following: You can call the function block as a “single instance” or as a “local in- 
stance” (“multi-instance”). With a single instance, the call is assigned a separate da- 
ta block as instance data block. When calling a local instance, the called function 
block stores its instance data in the instance data block of the calling function block. 
You then specify the name with which the local instance can be addressed in the 
static local data of the calling function block. You can repeatedly call a function 
block as a local instance using different names in each case. 


Fig. 5.11 shows an example of calling a function block (FB) as a local instance in the 
various programming languages. The function block in the example is named 
“Motor”, the assigned instance data is named #Motor_Instance. 


If a function block is not capable of multi-instance — the Multiple instance capability 
attribute is not activated — it can only be called as a single instance. A function block 
with multi-instance capability can be called as a single instance and as a local 
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Calling a function block as local instance 


LAD FBD 
#Motor_Instance #Motor_Instance 
B26 ‘B26 
“Motor” “Motor” 
EN ENO == EN 
— Switch-on Motor 1... ‘sise —= Switch-on Motor — ... 
— Switch-off Display +... — Switch-off Display — ... 
Ise — Fault e — Fault ENO — 
STL 
1 CALL #Motor_ Instance 
2 Switch-on := 
3 Switch-off := 
4 Fault = 
5 Motor = 
6 Display := 
SCL 13 Hi#Motor_ Instance (Switch-on:=_bool_in , 
14 Switch-off:=_bool_in, 
15 Fault:=_bool_in, 
16 "Motor"=>_bool_out_, 
17 Display=>_bool_out_); 
18 


Fig. 5.11 Calling a function block as local instance 


instance. A function block without multi-instance capability can contain local 
instances. 


Supplying the block parameters 


The block parameters of a function block are located in the instance data. Therefore 
not all block parameters have to be supplied when calling the function block. If the 
supply is omitted, the function block works with the “old” values from its last call 
or with the default settings. In/out parameters with complex data type are an excep- 
tion; these must be supplied during the first call so that a valid pointer is entered 
into the instance data. You can supply EN and ENO as required with the graphic pro- 
gramming languages. 


You can use tags from the inputs, outputs, and bit memories operand areas for all 
block parameters. Constants and peripheral inputs are only permissible for input 
parameters, peripheral outputs only for output parameters. When using data tags, 
you are strongly recommended to use complete addressing (“Data block”.Data tag”) 
since the programming interface does not indicate which data block has been cur- 
rently opened by the program editor. 


The data type of the actual parameter must correspond to the data type of the block 
parameter. The data types must agree exactly if the IEC check attribute is activated 
in the calling block, otherwise matching widths of the data type or operand are usu- 
ally sufficient. 
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An input or output parameter of a function block with data type STRING can only be 
supplied with STRING tags whose maximum length corresponds to that of the block 
parameter. Any maximum length of the STRING tag is possible on an in/out param- 
eter. Note that an actual parameter with data type STRING which has been declared 
in the temporary local data cannot be assigned a default value and therefore has 
any content. It must be provided with meaningful values before being used as an 
actual parameter. 


Tags with elementary data type and pointers (e.g. P#DB10.DBX20.5) are permissible 
on block parameters with parameter type POINTER. These can also be completely 
addressed data tags or components of an array or data structure. 


Tags of all data types are approved for block parameters with parameter type ANY. 
The tags which must be connected to the block parameters or which are meaningful 
are defined by the programming within the called block. You can also specify a con- 
stant with the format of the ANY pointer “P#[Data block.]Operand Data type 
Quantity”, and thus define an absolutely addressed area. Supplying with temporary 
local data of data type ANY is handled separately (see Chapters 4.6.3 ““Variable” 
ANY pointer with STL” on page 138 and 4.6.4 ““Variable” ANY pointer with SCL” on 
page 138). 


Chapter 18.5.6 “Data storage of a local instance in a multi-instance” on page 739 
shows how the block parameters and the static local data are saved when calling as 
a local instance in a multi-instance. 


“External” access to local data 


The block parameters of a function block are located in a data block. If a block 
parameter is saved as a value (not as a pointer), you can address it from any position 
in the user program like a global data tag. The address for a single instance is 
“Data block”.Parameter name and for a local instance “Data block”.Instance name. 
Parameter name. 


Block parameters with data types POINTER and ANY as well as in/out parameters 
with complex data types are saved as pointers. 


5.3.4 “Passing on” of block parameters 


The “passing on” of block parameters is a special form of access and supply of block 
parameters. The parameters of the calling block are “passed on” to the parameters 
of the called block. In this case, the formal parameter of the calling block is then the 
actual parameter of the called block. 


It always applies here that the actual and formal parameters must be of the same 
type, i.e. the associated block parameters must agree with regard to their data 
types. Note in this context that the maximum length may have to be considered with 
data type STRING. 


It additionally applies that you can only connect an input parameter of the calling 
block to an input parameter of the called block, and an output parameter only to an 
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output parameter. You can connect an in/out parameter of the calling block to all 
declaration types of the called block. 


Exceptions: Complex data types in input and output parameters can only be passed 
on if the calling block is a function block. Block parameters with parameter types 
TIMER, COUNTER and BLOCK_xx can only be passed on by an input parameter to an- 
other input parameter if the called block is a function block. 


The “passing on” of block parameters also applies in the same manner to state- 
ments (program functions) which are represented with inputs and outputs similar 
to ablock call. If these statements are supplied with block parameters, input (block) 
parameters can only be connected to function inputs, output (block) parameters 
only to function outputs. In/out parameters can be connected to function inputs and 
outputs. 


3.4 Startup program 


During the power up, a CPU 400 performs a cold restart, a warm restart, or a hot re- 
start depending on the default setting and requirement. The activities carried out 
during the warm restart are described in Chapter 5.1.2 “STARTUP operating state” 
on page 145. 


5.4.1 Startup organization blocks OB 100, OB 101, and OB 102 


The startup program is present in the organization blocks OB 100, OB 101 and 
OB 102, and the blocks called within them. A startup program is not essential. If a 
startup program is not required, simply omit the respective organization block or 
all organization blocks. 


The startup program can have any length. There is no time limit for executing the 
startup program; the cycle time monitoring is not active. Application examples 
include the parameterization of modules if the parameter settings made by the 
CPU are to be changed and the programming of default settings for the main pro- 
gram. 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the startup organization blocks contains the tags 


OBxxx_STOP Number of the STOP event 
OBxxx_STRT_INFO Additional information on the current startup 
with xxx as number of the organization block. 


Using these tags, you can determine which event triggered the last STOP and with 
which event the CPU has been started, e.g. with a manual startup using the mode 
switch (see reference of the organization blocks in the STEP 7 help). With this infor- 
mation you can create an event-dependent startup program. 
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5.4.2 Determining a module address 


Signal modules, or more precisely the user data on input/output modules, are 
addressed in two manners: You use the logical address in the user program to 
address the inputs and outputs. This corresponds to the absolute address and can 
be made easier to read by using symbols. The smallest logical address of a module 
is the base address or module start address. The CPU addresses the modules using 
the geographic address. You require the geographic address if you wish to learn the 
module's slot. 


You can use the following system blocks to determine the geographic address from 
the logical address, and vice versa: 


> GEO_LOG Determine logical base address (SFC 70) 

> GADR_LGC Determine logical address of a module channel (SFC 5) 
> RD_LGADR Determine all logical addresses of a module (SFC 50) 

> LOG GEO Determine geographic address (SFC 71) 

> LGC_GADR Determine slot address of a module (SFC 49) 


Fig. 5.12 shows the graphic representation of the system blocks. These system 
blocks can be called in all priority classes, i.e. in the program of all organization 
blocks. 


System blocks for determination of module addresses 


(SFC 5 GADR_LGC) 


SFC 70 GEO_LOG SFC 50 RD_LGADR 


Sous rade, All logical 
address ==), address ==> addresses 
(SFC 49 LGC_GADR) PEADDR 

sae SFC71LOG_GEO [OID PECOUNT 
Or LADDR PAADDR 

PACOUNT 


The system functions SFC 70 GEO_LOG and SFC 71 LOG_GEO replace the respective system functions 
shown above them in parentheses. 


SFC 70 SFC 71 SFC 50 
Determine logical Determine geographic Determine all logical 
base address address addresses 
GEO_LOG LOG_GEO RD_LGADR 
—— MASTER RET_VAL—— —LADDR RET. VAL—— -—— IOID RET_VAL —— 
— STATION LADDR —— AREA —- -—— LADDR PEADDR —— 
— Stor MASTER —— PECOUNT —— 
— SUBSLOT STATION —— PAADDR —— 
Sian s— PACOUNT —— 
SUBSLOT —— 
fee — 


Fig. 5.12 Determining logical and geographic module addresses 
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The system function GEO_LOG supersedes the system function GADR_LGC, and the 
system function LOG_GEO supersedes the system function LGC_GADR. GEO_LOG 
and LOG_GEO have an extended functionality, e.g. they can also be used in the dis- 
tributed I/O in conjunction with PROFINET IO. The replaced system blocks will 
therefore not be described below. 


GEO_LOG Determine logical start address 


The system function GEO_LOG delivers the logical base address of a module or 
station. The assignment of the MASTER parameter indicates whether the station or 
module is inserted in a rack (central design) or whether the station is operated ina 
distributed PROFIBUS or PROFINET system. 


Specify the slot number in the rack or station in the SLOT parameter, and the number 
of the submodule in the SUBSLOT parameter. The LADDR parameter then delivers 
the base address of the submodule. The assignment of bit 15 decides whether the 
address is assigned to an input (= 0) or output (= 1). With SUBSLOT = 0, the diagnos- 
tics address of the module or station is delivered. 


LOG_GEO Determine geographic address 


The system function LOG_GEO delivers the geographic address of a module or 
station if you specify the logical base address for it in the LADDR parameter. The 
assignment of bit 15 decides whether the address is assigned to an input (= 0) or 
output (= 1). 


The value in the AREA parameter specifies the system in which the module is used 
(0 = S7-400, 1 = S7-300, 2 = distributed I/O). 


RD_LGADR Determine all logical addresses of a module 


The system function RD_LGADR returns all logical addresses of a module if any 
address from the user data range is specified for it in the IOID and LADDR parame- 
ters. IOID is either B#16#54 (corresponds to the inputs) or B#16#55 (for the out- 
puts). 


Connect an area comprising WORD components (a word-by-word ANY pointer, e.g. 
P#DBzDBXy.x WORD nnn) to the PEADDR and PAADDR parameters. The system func- 
tion RD_LGADR then shows the number of entries returned in these areas in the PE- 
COUNT and PACOUNT parameters. 


5.4.3 Parameterization of modules 


Most S7 modules can be parameterized, i.e. values can be set on the module which 
are different from the default settings. To set the parameters, open the module in 
the hardware configuration and complete the tabs in the displayed dialog. When 
started, the CPU automatically transfers the module parameters to the modules 
and for the distributed I/O following the “return” of a station. 


173 


5 Program execution 


Static and dynamic module parameters 


Module parameters are distinguished by static and dynamic properties. You can set 
both types of parameter offline in the hardware configuration. You can also change 
the dynamic parameters by calling a system block during runtime. Note that with a 
renewed startup the parameters set on the modules by the system blocks are over- 
written by the parameters set (and saved on the CPU) using the hardware configu- 
ration. 


Asynchronous processing of system blocks 


The system blocks for module parameterization and transmission of data records 
work “asynchronously”. This means that the result of the block function is not 
immediately available following processing of the block. Execution of the function 
extends over several calls and is triggered by the block parameter REQ = “1”. The 
BUSY parameter has signal state “1” during job execution, and the error informa- 
tion has the value W#16#7001 (job being executed). The error information for the 
system functions is in the RET_VAL parameter and for the system function blocks in 
bytes 2 and 3 of the STATUS parameter. 


A certain job for a module is specified by the module start address and the data re- 
cord number. As long as BUSY = “1”, arenewed call for the same job with REQ = “1” 
has no effect and the error information is set to W#16#7002. 


An error which occurs when triggering a job is signaled by the error information 
and BUSY remains “0”. 


BUSY has signal state “O” when the job has been completed. If completed without 
errors, the error information has the value W#16#0000; with the system function 
RD_REC, the number of transmitted bytes is present in RET_VAL. In the event of an 
error, the error information contains the error code. 


You can use a program loop in which the asynchronous system block is called in the 
startup program to “wait” for the end of job processing. You are advised not to do 
this in the main, interrupt or error program, since it can result in an undesirable 
delay in the cycle processing time and thus in the response time, and the cycle mon- 
itoring time may then be triggered. 


System blocks for module parameterization 
The following system blocks are The following system blocks are available with a 
CPU 400 for module parameterization: 
WR_PARM_ Write dynamic parameters (SFC 55) 
WR_DPARM_ Write predefined parameters (SFC 56) 
PARM_MOD Assign module parameters (SFC 57) 
WR_REC_ Write data record (SFC 58) 
RD_REC_ Read data record (SFC 59) 
RD_DPAR Read predefined parameters (SFB 81) 
RDREC Read data record (SFB 52) 
WRREC Write data record (SFB 53) 
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System blocks for module parameterization 


User memory of CPU Module 
Load memory Work memory (SFC 55 WR_PARM) | module 
(SFC 58 WR_REC) memory 
soe oe SFB 53 WRREC 
SFB 81 RD_DPAR 
aaa Parameter- (SFC 59 RD_REC) 
Static and ization data SFB 52 RDREC 
dynamic Module 
parameters Qa parameters 
(SFC 56 WR_DPARM) 
(SFC 57 PARM_MOD) 


The blocks shown in bold type have an expanded functionality. They replace the blocks shown above 
them in parentheses, and should be preferred when creating new control programs. 


Instance data 


SFB 81 
Read predefined SFB 52 SFB 53 
parameters Read data record Write data record 


Instance data 


Instance data 


RD_DPAR RDREC WRREC 

— REQ VALID — — REQ VALID — — REQ DONE — 

— LADDR BUSY — —ID BUSY — —ID BUSY — 

— INDEX ERROR —- —— INDEX ERROR —- — INDEX ERROR — 

— RECORD STATUS —- — MLEN STATUS —- — LEN STATUS — 
LEN — — RECORD LEN — — RECORD 


Fig. 5.13 System blocks for module parameterization and transmission of data records 


Fig. 5.13 shows a graphic representation of the available system blocks. The high- 
lighted system blocks supersede the system blocks above them in parentheses. 
Some have an extended functionality, e.g. they can also be used in the distributed I/O 
in conjunction with PROFINET IO. The replaced system blocks will therefore not be 
described below. 


Module and data record addressing 


You use the module start address for transmission of data records. In the case of 
hybrid modules which have input and output areas, you use the lower area start 
address. If the input and output areas have the same start address, use the ID for an 
input address. You use the I/O ID irrespective of whether you wish to carry out a 
read or write operation. 


Parameterization of the module start address is carried out using the ID or LADDR 
parameter. The assignment of bit 15 determines whether it is an input (=0) or 
output (= 1). 
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You apply an actual parameter which corresponds to an area of BYTE components 
to the RECORD parameter with data type ANY. This can be a tag with data type 
ARRAY, STRUCT or with a PLC data type, or a byte-serial ANY pointer (for example 
P#DBzDBXy.x BYTE nnn). If you use a tag, it can only be a “complete” tag; individual 
array or structure components are not permissible. 


RD_DPAR Read predefined parameters 


The system function block RD_DPAR transfers the data record with the number 
specified in the INDEX parameter from the corresponding system data block SDB to 
the destination area specified in the RECORD parameter. 


The transmission is carried out asynchronously and can be divided between several 
program cycles; the BUSY parameter has signal state “1” during the transmission. 
Following a successful transmission, the VALID parameter has signal state “1” and 
the number of data bytes transferred is present in the LEN parameter. 


The read data record can then be evaluated, for example, or modified and written 
by the WRREC system block to the module. 


RDREC Read data record 


With “1” in the REQ parameter, the system function block RDREC reads the data re- 
cord INDEX from the module and saves it in the destination area RECORD. The des- 
tination area must have the same length as the data record, or longer. The MLEN pa- 
rameter specifies how many bytes are to be read. 


The transmission can be divided between several program cycles; the BUSY param- 
eter has signal state “1” during the transmission. 


Signal state “1” in the VALID parameter signals that the data record has been read 
without errors. The LEN parameter then indicates the number of transferred bytes. 
In the event of an error, ERROR is set to “1”. Error information is then written to the 
STATUS parameter. 


WRREC Write data record 


With “1” in the REQ parameter, the system function block WRREC writes the data re- 
cord INDEX from the source area RECORD to the module. The LEN parameter spec- 
ifies how many bytes are to be written. 


The transmission can be divided between several program cycles; the BUSY param- 
eter has signal state “1” during the transmission. 


Signal state “1” in the DONE parameter signals that the data record has been writ- 


ten without errors. In the event of an error, ERROR is set to “1”. Error information 
is then written to the STATUS parameter. 
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5.5 Main program 


The main program is the cyclically processed user program; this is the “normal” 
way in which programs are executed in PLCs. The large majority of control systems 
only use this form of program execution. If event-driven program execution is 
used, it is usually only an addition to the main program. 


5.5.1 Organization block OB 1 


The main program is present in organization block OB 1 and the blocks called with- 
in it. It executes at the lowest priority level and can be interrupted by all other types 
of program execution. 


The length of the main program is limited by the available memory space. The time 
available for execution of the main program with all interrupt events occurring in 
the current processing cycle is limited by the cycle time monitoring (see Chapter 
5.5.3 “Cycle time and response time” on page 182). 


Prior to commencement of a new processing cycle - quasi at the start of the main 
program - the process image of the outputs is transferred to the I/O modules and 
the process image of the inputs is updated (see Chapter 5.5.2 “Process image” on 
page 177). 


Execution of the main program can be interrupted by interrupt or error events. The 
corresponding organization blocks are then called and processed. Following pro- 
cessing of such an interruption, processing is continued in the main program at the 
point of interruption (see Chapters 5.6 “Interrupt processing” on page 196 and 5.7 
“Error handling” on page 213). 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the OB 1 contains the tags 


OB1_PREV_CYCLE Runtime of previous cycle (in ms) 
OB1_MIN_ CYCLE Minimum cycle time since the last startup (in ms) 
OB1_ MAX CYCLE Maximum cycle time since the last startup (in ms) 


Using these tags you can determine the current cycle time and its fluctuation per 
program. 


5.5.2 Process image 


The process image is part of the CPU's internal memory. The process image consists 
of the process image input (operand area “Inputs I”) and the process image output 
(operand area “Outputs Q”). It commences in each case at address 0 (zero) and ends 
at an adjustable upper limit. The process image input and output can be comprised 
of several process image partitions, independent of one another. The updating of 
the process image (partitions), i.e. the data transfer from and to the modules, can 
take place automatically or be controlled by system functions via the user program. 
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Benefits of a process image 


The use of a process image has many benefits: 


D> 


Inputs can be scanned and linked bit-by-bit, and outputs can be set and reset bit- 
by-bit. In contrast, I/O bits cannot be addressed directly. 


The scanning of an input or the controlling of an output is significantly faster 
than the addressing of an input or output module, e.g. the setting times at the 
I/O bus are omitted and the response times of the system memory are shorter 
than the response times of the module. This means that the program is executed 
faster. 


Inputs can also be set and reset since they are stored in a Random Access Memo- 
ry. Digital input modules can only be read. The setting of the inputs can simulate 
encoder statuses during the program test or the commissioning, thereby simpli- 
fying the program test. 


Outputs can also be scanned since they are stored in a Random Access Memory. 
Digital output modules can only be written. The scanning and linking of the out- 
puts does away with the additional saving of output bits to be scanned. 


The signal state of an input is the same throughout the entire program cycle (da- 
ta consistency during a program cycle). If a bit on an input module changes, the 
change of the signal state is transferred to the input at the start of the next pro- 
gram cycle. 


A multiple signal state change of an output during a program cycle has no effect 
on the bit on the output module. The signal state of the output at the end of the 
program cycle is transferred to the module. 


The downside of these benefits is an increased response time of the program; see 
Chapter 5.5.3 “Cycle time and response time” on page 182 for more details. 


Adjustable size of process image 


The maximum size of the process image depends on the highest I/O address of the 
CPU. The size that is actually utilized can be set in the CPU properties under Cycle 
and Size of process image of inputs or Size of process image of outputs (Table 5.3). 
Note that the process image is part of the code work memory: If a smaller process 
image is selected, more space is available for the user program code (as of Firmware 
V6.0, one process image byte requires 20 bytes in the work memory). 


Table 5.3 Size of the process image for a standard CPU 400 


Process image update CPU 412 CPU 414 CPU 416 CPU 417 
Inputs Preset 128 256 512 1024 
(number of Adjustable up to 4096 8192 16 384 16 384 
bytes) 

Outputs Preset 128 256 512 1024 
(number of Adjustable up to 4096 8192 16 384 16 384 
bytes) 
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Theoretically, all modules can be addressed in the process image. Normally, the ad- 
dresses of the digital modules are in the process image area, but not the addresses 
of the analog, FM and CP modules. 


The memory areas for the process images — the operand areas inputs and outputs — 
are always available, regardless of the actually existing input/output modules, in 
full length (set) and can be addressed by all of the functions and statements. The 
process image areas that are not occupied by module addresses can be used like the 
bit memories. 


Process image partitions 


With a CPU 400, you can divide the process image into as many as 15 process image 
partitions. You make the division when parameterizing the signal modules by de- 
fining which process image partition the module is assigned to when assigning ad- 
dresses. Make the division separately for the process image input and process im- 
age output. A module can only be assigned to a single process image partition and 
only with all of its addresses. All of the modules addressed in the process image 


Module addresses and process images for a CPU 400 


Set upper limit Max. I/O address = 
of process image | max. process image address 


Addresses 
start on byte 0 


@ Addresses 


@ Modules 


TPA 1 
@ 4... 
TPA 15 


@ _ 0B1-PA 


@ The maximum number of possible I/O addresses is a property of the respective CPU. 
The process image is configured such that all I/O addresses (all module addresses) can be within 
the range of the process image. You can set the process image range that is actually used; 
it should be as small as possible. 


@ The module addresses correspond to the I/O addresses. They can be in the entire address range 
and need not be without gaps. 


@® The addresses of a module that are in the range of the process image can be assigned to a 
process image partition. The assignment is arbitrary and includes all addresses of a module. 
The user data of all modules assigned to a process image partition can be updated automatically 
or with system functions. 


@ The addresses of the modules that are within the process image area and are not associated 
with any process image partition are in the OB1 process image (OB1-PA). The user data of the 
modules whose addresses are in the OB1 process image is updated automatically by default. 
The automatic updating can be switched off and - if necessary - may be replaced with system 
functions by an update. 


© The user data of the modules whose addresses are outside the process image area is not updated. 
This user data can only be read and written in direct access. 


Fig. 5.14 Assignment between module addresses and process image partitions 
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which you do not assign to a process image partition (TPA 1 to TPA 15) are in the 
OB1 process image OB1-PA (Fig. 5.14). 


Assigning a module to a process image partition makes sense if all of the user data 
of the module is processed in an interrupt routine or if specific program sections 
are to be provided with their own process image. If you use the synchronous cycle 
interrupt, you must assign the participating modules to a process image partition. 


You can configure the assignment of a process image partition to an interrupt rou- 
tine in the CPU properties: In the Interrupts property group, select the interrupt 
class and assign the process image partition to the organization block in the table 
(not for DPV1 interrupts). 


Automatic update of the process images 


The OB1 process image is automatically updated in each processing cycle by the 
CPU operating system before the processing of the main program. This automatic 
updating of the OB1 process image can be switched off in the CPU properties (under 


Automatic update of the process images 


Update of the OB1 process image 


If automatic updating of the OB1-PA is activated, then on the cyclic execution of the main program, 
the OB1 process image is first transferred to the outputs and then the OB1 process image input is 
updated. This is then followed by the execution of the main program. 


If the processing time of the main program is less than a configured minimum cycle time and 


background processing is enabled, the background program is continued to be executed for a while. 
Then the next program cycle begins with the transfer of the process image output. 


Start of the current 
cyclic processing 


Continuation Start of the next 
of background cyclic processing 


processing 
Actual cycle time OB1 


PIQ Pll Main program Backround program PIQ Pll Main program 


Minimum cycle duration t 


Update of an assigned process image partition 


If a process image partition is assigned to an interrupt routine, the processing of the interrupt 

routine is initiated with the update of the process image partition input. This is followed by the 
processing of the interrupt organization block. At the end of interrupt processing, the process 

image partition output is transferred to the output modules. 


Start of End of 
interrupt processing interrupt processing 


Execution time of the interrupt routine 


PIQ = OB1 process image of the outputs 

PII = OB1 process image of the inputs 

TPII Interrupt routine TPIQ TPIQ = Process image partition of the outputs 
TPII = Process image partition of the inputs 


Fig. 5.15 Automatic process image update 
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Cycle, deactivate the checkbox Cyclically update process image). A process image 
partition which is assigned to an organization block is automatically updated by the 
CPU operating system when the organization block is called up. (Fig. 5.15). 


In the CPU properties under Cycle and OB85 call on I/O access error, you can set the 
response to an I/O access error: 


> For each individual access 
The CPU creates an entry in the diagnostic buffer for each erroneous access and 
calls up the organization block OB 85 Program execution error every time. 


> Only for coming and going errors 
Only when the I/O access error comes and when it goes again is an entry made in 
the diagnostic buffer and the OB 85 organization block is called. Before OB 85 is 
called, the corresponding input bytes are set to zero until the error is cleared. 


> No OB85 call 
No entry is made in the diagnostic buffer, the organization block OB 85 is not 
called, and the corresponding input bytes are set to zero until the error is 
cleared. 


If a module with addresses that occupy four bytes (one doubleword) cannot be ac- 
cessed, the OB 85 starts once. If the module has a larger address area, the OB 85 
starts each time there is a doubleword access to the module. 


Process image update with system blocks 


The system functions UPDAT_PI and UPDAT_PO are available for updating the pro- 
cess image partitions via the user program. In the synchronous cycle interrupt or- 
ganization blocks, you can use the system functions SYNC_PI and SYNC_PO for up- 
dating the process image partitions (see Chapter 5.6.8 “Synchronous cycle inter- 
rupts, organization blocks OB 61 to OB 64” on page 209). 


UPDAT_PI Update process image partition of inputs 
UPDAT_PO Update process image partition of outputs 


The system function UPDAT_PI updates a process image partition of the inputs, the 
system function SFC 27 UPDAT_PO updates a process image partition of the out- 
puts. You can also use these system functions to update the OB1-PA (Fig. 5.16). 


System blocks for updating of process image partitions 


SFC 26 SFC 27 
Update process image Update process image 
partition of inputs partition of outputs 
UPDAT_PI UPDAT_PO 
— PART RET Als — — RAR RET_VAL —— 
EEADDR3s— FLADDR —— 


Fig. 5.16 System functions for a process image update 
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You can call these system functions at any point in the user program. You enter the 
number of the process image partition (1 to 15) at the PART parameter. You can se- 
lect the OB1 process image with a zero at the PART parameter. The selected process 
image partition may not be automatically updated (no assignment to an interrupt 
organization block or deactivation of the cyclic updating of the OB1-PA) and it may 
not be updated with the system functions SYNC_PI or SYNC_PO. 


The updating of a process image can be interrupted by an organization block with 
a higher priority class. If an error occurs during the updating of the process image, 
e.g. because a module can no longer be addressed, it is reported back to the system 
function via the function value RET_VAL. The first error-causing address is then lo- 
cated in the FLADDR parameter. 


5.5.3 Cycle time and response time 


Cycle processing time 
The cycle processing time comprises: 


The entire execution time of the main program (execution times of the 
program in OB 1 and all of the blocks called up in it) 


The processing times for higher priority classes which interrupt the 
main program (in the current cycle) 


The time required to update the process images 


The time for communication processes by the operating system, e.g. access 
operations of programming devices to the CPU (program status!). 


Communication load 


The CPU's operating system requires a certain time for communication with the 
programming device or with other stations. In the CPU properties, you can set the 
percentage of the cycle time which is to be available for communication tasks. If you 
set a high percentage, it may be necessary to adapt the cycle monitoring time. 20% 
is set by default. 


Independent of this setting, the CPU carries out communication tasks in a specific 
time scale. This should guarantee that the CPU can still be accessed and switched to 
STOP, for example, in the event of an endless loop with restarting of the cycle mon- 
itoring time. 


Cycle statistics 


If you are connected online with the programming device to arunning CPU, you can 
use the Online & diagnostics command from the project tree to start the task card 
with the online tools. The Cycle time section shows the shortest, current, and lon- 
gest cycles (processing) time in milliseconds and presents these graphically. 
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You can also obtain data on the current cycle time of the last cycle as well as the min- 
imum and maximum cycle times since the last startup from the start information 
of organization block OB 1. 


Cycle monitoring time 


The cycle monitoring time monitors the duration of the execution of the main pro- 
gram, including the process image update and all of the interruptions in the cur- 
rent program cycle. The cycle monitoring time is set to 150 ms by default. 


You configure the cycle monitoring time in the CPU properties: You enter the time 
in milliseconds under Cycle and Cycle monitoring time. The maximum cycle moni- 
toring time is 6000 ms. 


If processing of the main program takes longer than the set cycle monitoring time, 
the CPU calls the organization block OB 80 Time error. If this is not present, the CPU 
switches to STOP. 


RE_TRIGR Restart cycle monitoring time 


RE_TRIGR restarts the cycle monitoring time. This then starts with the value set 
during CPU parameterization. RE_TRIGR does not have any parameters (Fig. 5.17). 


System block for retriggering the cycle monitoring time 


SFC 43 
Retrigger cycle monitoring time 


RE_TRIGR 


Fig. 5.17 System block for retriggering the cycle monitoring time 


The RE_TRIGR function is only effective when called in the main program. The cycle 
monitoring time is not restarted by a call in the startup program or in an interrupt 
routine, and ENO has the signal state “0”. 


Response time 


If the user program in the main program works with the signal states of the process 
images, this results in a response time which is dependent on the cycle execution 
time ( cycle time): The response time lies between one and two cycle times, as 
demonstrated in the following example (Fig. 5.18) . 


If a limit switch is activated, for example, it changes its signal state from “0” to “1”. 
The PLC detects this change during subsequent updating of the process image and 
sets the input allocated to the limit switch to “1”. The program evaluates this change 
by resetting an output, for example, in order to switch off the corresponding drive. 
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Response times when using process images 


Change in sensor signal A PIQ = Process image “ the outputs 
with immediate transfer Change in PU = Process tmage of the inputs 
to process image output signal 


Response time = one cycle time 


PIO} Rit User program PION Pil User program lo) | ll 
A 
Change in sensor signal Transfer to Change in 
without transfer to process image output signal 


process image 
Response time = two cycle times 


Fig. 5.18 Response times of programmable logic controllers 


The new signal state of the output that was reset is transferred at the end of program 
execution; only then is the corresponding bit reset on the digital output module. 


In a best-case situation, the process image is updated immediately following the 
change in the limit switch's signal. It then only takes one cycle for the correspond- 
ing output to respond. In a worst-case situation, updating of the process image has 
just been completed when the limit switch's signal changes. It is then necessary to 
wait approximately one cycle for the PLC to detect this change and to set the input 
in the process image. The response then takes place after one further cycle. 


The response time to a change in the input signal can thus be between one and two 
cycles. Added to the response time are the delays for the input modules, the switch- 
ing times of contactors, and so on. 


In certain cases you can reduce the response times by addressing the I/O directly or 
by calling program sections depending on events (hardware interrupt). 


Uniform response times or equal time intervals in the process control can be 
achieved if a program section is always executed at regular intervals, e.g. a cyclic 
interrupt program. Program execution isochronous with the processing cycle of a 
PROFIBUS DP master system also results in calculable response times. 


5.5.4 Minimum cycle time and background processing 


Minimum cycle time 


You can specify a minimum cycle time for a CPU 400. If the execution time of the 
main program, including the process image updating and the interruptions, is less 
than the specified minimum cycle time, the CPU will wait for the minimum cycle 
time to elapse before it starts the next program cycle. 
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With a minimum cycle time, you can balance seriously fluctuating cycle execution 
times, which also influence the response time of the controller. The specifying of a 
minimum cycle time is a prerequisite for executing a background program. 


You configure the minimum cycle time in the CPU properties: You enter the time in 
milliseconds under Cycle and Minimum cycle time [ms]. The default entry 0 (zero) 
deactivates the minimum cycle time. The maximum minimum cycle monitoring 
time is 6000 ms. The minimum cycle time must be set so that it is less than the cycle 
monitoring time. 


If a background program is to be executed, the minimum cycle time must be longer 
than the anticipated cycle execution time, because the background program is exe- 
cuted in the difference of the two times. 


Background program, organization block OB 90 


In the span of time between the actually required cycle execution time and the 
elapsing of the minimum cycle time the CPU executes the organization block OB 90 
Background processing with all of the blocks called up in it (see Fig. 5.15 on page 
180). 


OB 90 is processed “piece by piece”: Processing in OB 90 is interrupted when the or- 
ganization block OB 1 is called by the operating system, and continued again at the 
point of interruption when OB 1 processing is concluded. The interruption by OB 1 
can take place after each statement; any system block that has been called in OB 90 
is processed to completion, however. 


The duration of processing of a “piece” depends on the current cycle execution 
time. The closer the cycle processing time is to the minimum cycle time, the less 
time remains for processing OB 90. The program processing time is not monitored 
in OB 90. 


Processing of OB 90 only takes place in RUN mode. It can be interrupted by interrupt 
and error events, just like the processing of the main program. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the OB 90 contains the tag 


OB90_STRT_INF Start event for OB 90 


With the aid of these tags, you can define for each program which events will cause 
the program execution in OB 90 to start again from the beginning: 


B#16#91 after a CPU startup 
B#16#92 after a block processed in OB 90 has been deleted or replaced 
B#16#93 after (renewed) loading of OB 90 in RUN mode, 


B#16#95 after the program in OB 90 has been executed and a new background 
cycle begins 


Note: The priority class 29 specified in the tag OB90_PRIORITY corresponds to the 
execution priority 0.29 and is thus lower than that of OB1 with priority 1. 
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5.5.5 Compress, hold, stop, and protect program 


COMPRESS Compress user memory 


After repeated deleting and reloading of blocks, for example when modifying 
blocks online, gaps can form in the work memory in the CPU and the RAM load 
memory that reduce the usable storage area. The “compress” function can be used 
to trigger a program in the CPU operating system that fills these gaps by pushing 
the blocks together. You can initiate a “compress” operation with a connected pro- 
gramming device or by calling the system function COMPRESS (for graphic repre- 
sentation see Fig. 5.19). 


Systembausteine zur Programmsteuerung 


SFC 25 SFC 46 SFC 47 
Compress Stop program Hold program 
user memory execution execution 
COMPRESS STP WAIT 
RET_VAL —— — WT 
BUSi\e— 
DONE;— 
SFC 109 
Change protection level 
PROTECT: Job identification MODE 
PROTECT 
W#16#0000 Set protection level 1 
—— MODE RET_VAL —— W#16#0001 Set protection level 2 
W#16#000C Set protection level 3 


Fig. 5.19 System blocks for program control during runtime 


The compression process is distributed over several program cycles. With BUSY = 
“1”, COMPRESS reports that it is still active. With DONE = “1”, COMPRESS reports the 
completion of the compressing process. COMPRESS cannot compress if you are cur- 
rently running an external compression process, if the “erase block” function is ac- 
tive, or if programming device functions are currently accessing the block to be 
moved (such as program status). 


Note that blocks above a certain CPU-specific maximum length cannot be moved 
with COMPRESS. Gaps thus remain in the CPU memory. Only the compression in 
STOP mode triggered by the programming device closes all the gaps. 


STP Stop program execution 


The system function STP terminates program execution; the CPU then switches to 
the STOP operating state. STP has no parameters (graphic representation is shown 
in Fig. 5.19). 


The CPU terminates processing of the user program and updates the process image 
output. In the module properties of correspondingly designed modules, you can set 
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the signal states of the digital and analog outputs which the CPU is to output in the 
STOP state: Retain last value or Connect substitute value. As standard, the signal state 
“0” is output at the digital outputs and a value of zero at the analog outputs at STOP. 


In the STOP operating state, the CPU continues communication with the program- 
ming device and the diagnostics activities. 


WAIT Hold program execution 


The system function WAIT holds program execution for a defined duration (for 
graphic representation see Fig. 5.19). 


The system function WAIT has the input parameter WT with data type INT in which 
you can specify the hold time in microseconds (us). The maximum hold time is 
32 767 ps, the smallest possible hold time corresponds to the CPU-dependent 
execution time of the system function. 


WAIT can be interrupted by events of higher priority. 


PROTECT Change program protection 


The user program in a CPU can be protected against access in three protection 
levels: no protection, write protection, and read/write protection. You can set the 
protection level when parameterizing the CPU. 


Program-driven toggling between protection levels “No protection” and “Write pro- 
tection” is possible with the system function PROTECT (for graphic representation 
see Fig. 5.19). Calling the system function PROTECT is only effective if you have set 
the protection level “No protection” with the hardware configuration. It has no ef- 
fect if write protection or read/write protection is set. 


The protection level set with PROTECT remains unchanged if 
> the CPU goes to STOP due to a (program) error, an STP call, 
or operator intervention, or 
> after switching the power supply off and on again. 
In all other cases, the protection level “No protection” is set in the case of an oper- 


ating mode transition. Even if you switch the mode switch to STOP, protection level 
“No protection” is (re)set. 


During runtime, you can scan the current protection level with system function 
R-SYSST via the system state partial list W#16#0232 with the index W#16#0004. 


5.5.6 Time 


A CPU 400 has a real time clock with a resolution of one millisecond. If the clock is 
supplied with the backup voltage, the deviation will be a maximum of 1.7 s per day. 
In the unbuffered state and with POWER ON, the deviation is a maximum of 8.6 s 
per day. The deviation can be compensated for using a correction factor. 


The clock can be synchronized and can be set or queried using a programming 
device or system blocks. The time is represented in the user program in 
DATE_AND_TIME format, thus comprising the date, time, and day of week. 
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WR SYS T Set time-of-day 


WR_SYS_T sets the clock in the CPU to the value specified at the IN parameter (Fig. 
5.20). The clock time is set to standard time. If a master clock is parameterized in 
the CPU - for example at the MPI - the time synchronization is started in addition. 
The error information is output in the RET_VAL parameter (0 = no error). 


Set, read and synchronize time of day 


SFC 0 SFC 1 SFC 48 
Set time of day Read time of day Synchronize time-of-day 
WR_SYS_T RD_SYS_T SNC_RTCB 
Date_And_Time Date_And_Time 
—— —_— RET_VAL —— 
— IN RET_VAL —— RET_VAL —— 
OUT — 
SFC 100 
Set and read time of day 
SET_CLKS Time-of-day status 
—— MODE RETVAL — 45 —_ “9” = The correction value is positive 
— PDT 14 
— CORR 13 
SUIVIVER 12 Correction value 
~~] 11 Local time = Module time + Correction value x 0.5 h 
— ANN_1 10 
90 


—— “0” = Switchover takes place in the next hour 
— “0” = standard time, “1” = daylight saving time 


The system function RDSYSST 
reads the system status list and 
with SZL_ID = W#16#0132 and 
INDEX = W#16#0008 it indicates 
the time-of-day status in the 
status tag 


Resolution of time 
16#00 = 1 ms 16#01 =10 ms 
16#10 =100 ms 16#11=1s 


— “1” =Synchronization has taken place 


OFNWAUDANO 


Fig. 5.20 System blocks for time control 


RD_ SYS T Read time-of-day 


RD_SYS_T reads the current time of the CPU and outputs it at the OUT parameter 
(Fig. 5.20). The error information is output in the RET VAL parameter (0 = no er- 
ror). 


SET_CLKS Set time-of-day and time-of-day status 

The operating modes of SET_CLKS are set at the MODE parameter: 
> MODE =B#16#01 Only set time-of-day 

> MODE =B#16#02 Only set time-of-day status 

> MODE = B#16#03 Set time-of-day and time-of-day status 
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The time-of-day is specified at the PDT parameter in the data format DATE_AND - 
TIME (Fig. 5.20). The parameter SUMMER defines whether the time is to be import- 
ed as daylight saving time (SUMMER = “1”) or as standard time (SUMMER = “0”). The 
time switch is announced using parameter ANN_1: ANN_1 = “1” announces that a 
switch-over from daylight saving time to standard time or vice versa is to take place 
on the next hour. 


At parameter CORR, the time difference between the module time and the local time 
is specified (see below). A unit corresponds to 30 minutes. This corrective value can 
also be negative. 


The error information is output in the RET_VAL parameter (0 =no error). If a master 
clock is parameterized in the CPU - for example at the MPI - then the time synchro- 
nization is also started when the clock time is set. 


Module time, local time 


The time used in the CPU is the module time. This is decisive for all timing process- 
es controlled by the CPU such as runtime meter, starting of time-of-day interrupts, 
or entry of time stamps in the diagnostics buffer and in the start information of an 
organization block. You can use the system functions for the CPU clock to set and 
read the module time. 


A CPU 400 also saves a “time-of-day status”. You can read the time-of-day status us- 
ing the system function RDSYSST Read system status list with the SZL_ID = 
W#16#0132 and the INDEX = W#16#0008 in the tag status. The assignment of the 
time-of-day status is shown in Fig. 5.20. 


The local time (displayed time) can be used to visualize time zones. 


Loadable standard blocks facilitate the change-over from daylight saving to stan- 
dard time of the local time in the user program, especially the start of time-of-day 
interrupts depending on the local time. These blocks can be found in the program 
elements catalog under Expanded statements > Date and time > Local time: 


> LOC_TIME Determine local time (FC 60) 
The function LOC_TIME reads the clock time and the time-of-day status of the 
CPU clock and calculates the local time and time identification (daylight sav- 
ing/standard time) from it. 


> BT_LT Conversion of module time to local time (FC 61) 
The function BT_LT calculates the local time from a specified module time. The 
data required for this is in a data block with the data type WS_RULES (UDT 60). 


> LT_BT Conversion of local time to module time (FC 62) 
The function LT_BT calculates the module time from a specified local time. The 
data required for this is in a data block with the data type WS_RULES (UDT 60). 


> S_LTINT Setting time-of-day interrupt according to local time (FC 63) 
The function S_LTINT calculates the module time from a specified local time and 
thus sets the desired time-of-day interrupt. The data required for this is in a data 
block with the data type WS_RULES (UDT 60). 


189 


5 Program execution 


> SET_SW_ Switch-over of daylight saving/standard time (FB 60) 
The function SET_SW adjusts the time-of-day status corresponding to the cur- 
rent time in a CPU, which does not have the time-of-day status. The data required 
for this is in a data block with the data type WS_RULES (UDT 60). 


> SET_SW_S_ Switch-over of daylight saving/standard time with time-of-day sta- 
tus (FB 61) 
The function SET _SW_S adjusts the time-of-day status corresponding to the cur- 
rent time in a CPU, which does not have the time-of-day status. The data required 
for this is in a data block with the data type WS_RULES (UDT 60). 


Master clock and slave clock 


Time synchronization is possible over the MPI and DP interface. The time can also 
be synchronized with correspondingly designed CP modules. There can only be one 
master clock within a subnet. 


The CPU can be the master clock or slave clock. The setting as slave clock is only pos- 
sible on one interface. The CPU then receives the synchronization frame over this 
interface, which it can be passed on via the other interfaces. These interfaces are 
then set as master clock. 


After the first setting of the master clock, a synchronization frame is automatically 
sent at the configured interval. Note that the clock is in the default setting when de- 
livered or following a firmware update of the CPU and must first be set in order to 
be able to send a synchronization frame. 


SNC_RTCB Synchronize time slaves 


Called up in the CPU that was configured as the master clock, SNC_RTCB synchro- 
nizes all time slaves in the bus segment regardless of the automatic interval (see 
graphical representation Fig. 5.20 on page 188). 


If the master clock has no time-of-day status, the slave clocks are synchronized with 
the standard time. The correction factor is zero. The local time then corresponds to 
the module time. If the master clock works with time-of-day status, the entire time- 
of-day status is also transferred, in addition to the clock time. Thus, you have the 
same local time (the same time zone) in the clock network on all of the CPUs. 


Configuration of time synchronization 


You configure the settings for time synchronization in the properties of the CPU 
during hardware configuration. 


If time synchronization is to be carried out on modules within the station, open the 
Clock section in the CPU properties and set the synchronization mode As master 
under Synchronization on the PLC. Select the time interval from a drop-down list (in 
the range from 1 second to 24 hours). 


If time synchronization is to be carried out over an interface, open the Clock or Time 
synchronization section in the interface properties and set the synchronization 
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mode. When setting as master clock, select the time interval from a drop-down list 
(in the range from 1 second to 24 hours). 


You use the correction factor to correct any variation in the time occurring within a 
24 hour period. Set a negative correction factor if the clock is fast. You set the cor- 
rection factor in the hardware configuration in the Clock section in the properties 
of the CPU under the corresponding interface. 


5.5.7 Determine system time and OB runtime 


Read system time 


The system time is updated at an interval of one millisecond for a CPU 400. The sys- 
tem time starts when the CPU is switched on. The system time runs for as long as 
the CPU is in the STARTUP or RUN operating state. The current value of the system 
time is “frozen” when at STOP or HOLD. For a hot restart, the system time continues 
to run starting at the saved value. A cold restart or warm restart resets the system 
time. 


The system time is present in the data format TIME, where only positive values are 
possible: TIME#0ms to TIME#24d20h31m23s647ms. In the event of an overflow, 
the system time restarts at TIME#0. 


You can use the system time, for example, to determine the current runtime of the 
CPU or to calculate the duration between two TIME_TCK calls by generating the dif- 
ference. 


TIME TCK Read system time 


The TIME _TCK system function reads the current system time. The RET_VAL param- 
eter contains the read system time in the TIME data format. Fig. 5.21 shows the 
graphic representation of the system function. 


Read system time and OB runtime 


SFC 64 SFC 78 
Read system time Read OB runtime 


TIME_TCK OB_RT 


RET VAL—— —— OB_NR RET_VAL — 
PRIO — 

LAST_RT — 

LAST_ET — 

CUR_T — 

CUR_RT — 

CUR_ET — 

NEXT_ET — 


Fig. 5.21 System functions TIME TCK and OB_RT 
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Determine OB runtime 


The operating system of a CPU 400 saves the runtimes of the organization blocks 
using an internal timer in a microsecond grid. In the transition from STOP to RUN, 
the timer starts, runs to the upper limit of 27‘! and begins again at zero. 


The data saved in the operating system can be read using the system function 
OB_RT for the last completed call and for the current call of the organization block. 
This enables you to determine the time load (utilization) of the user program. 


OB_RT Read OB runtime 


The system function OB RT reads the runtime of an organization block. Fig. 5.21 
shows the graphic representation of the system function. 


For the operating mode transition from STOP to RUN, the measured data is pre-as- 
signed with the initialization value -1 (DW#16#FFFF_FFFF). If no new value is avail- 
able at the time of the OB_RT call, because, for example, the requested organization 
block has not yet been called and executed, the initialization value is returned. 


OB_RT provides the last recorded measured data independently of whether the 
requested organization block is currently loaded, deleted or overwritten (over- 
loaded). 


If an error occurs during the execution of OB_RT, RET _VAL contains the error infor- 
mation. Otherwise, it contains the number of the organization block whose data 
was retrieved. The parameter PRIO displays the priority class of the scanned orga- 
nization block. 


When using OB _RT, a distinction is made between a call in the program of the orga- 
nization block to be measured and a call outside of the organization block to be 
measured. 


OB_RT is called outside of the organization block to be measured 


The system function OB _RT is not called in the program of the organization block 
whose runtime is to be determined. Example: OB RT is called in the OB 1 and is as- 
signed a value of 30 in the parameter OB_NR. The last captured times for OB 30 are 
then read. Specification of the synchronous error OB with the numbers 121 and 122 
is not permissible because these belong to the priority class of the error-causing or- 
ganization blocks and thus to their program. 


Fig. 5.22 shows some examples for the OB _RT call outside of the organization block 
to be measured. The initial values after a STOP-RUN transition are -1 (example ()). 


LAST_RT indicates the runtime in microseconds of the last completed OB execution 
(examples @) to ©). The “net” runtimes are output. Interrupt times caused by OBs 
with higher priority classes are not included in LAST_RT (@). 


LAST_ET indicates the time period in microseconds between the start request and 
the end of processing for the last completed execution of the organization block to 
be measured (examples @) to ©). Interrupt times caused by higher priority classes 
are included in LAST_ET (@). 
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OB_RT call outside of the organization block to be measured 


STOP} RUN 

i 
, © © @ © © 
7 ee ee ee ee 


tl t2 t3 t4t5 t6 t7 t8t9 t10 t171 t12 t13 t14 t15 t16 t17 t18 t19 t20 t21 t22 t23 


If OB_RT is called outside of the organization block to be measured, the parameter OB_NR is 
provided with the number of the organization block to be measured. 


a) Interruption by a higher-priority organization block 

b) Program execution in the organization block to be measured 

c) Start request of the organization block to be measured 

d) Call of OB_RT with OB_NR = xx (= number of the organization block to be measured) 


Values at the parameters of OB_RT 


Name @ @ ©) @ ©) © 
LAST_RT -4 4-8 i8—t7 (t14 -t13)+(t12-t11) | t19-t18 | t22-121 
LAST_ET -1 4-12 i8—t6 14-110 t19-t16 | t22-t17 
CURT =4 0 0 0 0 0 
CUR_RT = 0 0 0 0 0 
CUR_ET -4 0 0 0 0 0 
NEXT_ET -1 ay -4 1 -1 1 


Fig. 5.22 Call outside of the organization block to be measured 


CUR_T indicates the relative time in microseconds (status of the counter in the op- 
erating system) of the start request of the OB. After initialization CUR_T (@) con- 
tains -1. On completion of OB execution, CUR_T is set to zero. Since in these exam- 
ples OB_RT is called outside the organization block to be measured, OB_RT conse- 
quently outputs zero at this parameter. 


CUR_RT indicates the effective OB execution time until the call of OB_RT in micro- 
seconds. After initialization CUR_RT (@) contains -1. After completion of OB execu- 
tion, the value in CUR_RT is transferred to LAST_RT and CUR_RT is set to zero. Since 
in these examples the call of OB_RT takes place outside the organization block to be 
measured, the value is always zero. 


CUR_ET indicates the time period from the OB start request to calling of OB_RT in 
microseconds. After completion of OB execution, the value in CUR_ET is transferred 
to LAST_ET and CUR_ET is set to zero. Since in these examples the call of OB_RT 
takes place outside the organization block to be measured, the value is always zero. 
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NEXT_RT indicates the time from the next subsequent OB start request to calling of 
OB_RT in microseconds if further, unprocessed start requests are pending. A CPU 
400 does not use the parameter NEXT_RT, the value is always -1. 


OB_RT is called in the organization block to be measured 


OB_RT can also be called in the program of the organization block to be measured. 
The parameter OB_NR is then initialized with zero and the parameter RET_VAL re- 
turns the current OB number - in the case of error-free execution. The times for the 
organization block in which OB_RT is called are read. When calling in one of the 
synchronous error OBs with the numbers 121 and 122, this is the data of the orga- 
nization block causing the error, including the times of OB 121 or OB 122. 


Fig. 5.23 shows some examples for the OB_RT call in the program of the organiza- 
tion block to be measured. This can be directly in the OB program or in one of the 
blocks called there. The initial values after a STOP-RUN transition are -1. 


OB_RT call within of the organization block to be measured 


STOP! RUN 


tl t2 t3 t4 t5 t6 t7 t8 t9 t10 t11 t12 t13 14 t15 t16 t17 t18 t19 


If OB_RT is called within the organization block to be measured, the parameter OB_NR is 
provided with zero. 


a) Interruption by a higher-priority organization block 

b) Program execution in the organization block to be measured 
c) Start request of the organization block to be measured 

d) Call of OB_RT with OB_NR=0 


Values at the parameters of OB_RT 


Name ® © ® 

LAST.RT| 1 4-12 18-6 -1 (t16 — t13) + (t12-t11) 
LAST.ET| 1 i4-tl t8-t5 -1 16-19 

CUR_T t1 ‘5 19 19 t10 

cuRRT | t3-t2 | t7-t6 | (t114—t13)+(t12-t11)| (t15 —t13) 4 (t12 - 11) t18-t17 
cuURET | t3-t1 | t7-15 14-19 t15-19 t18-t10 
NEXT.ET|  —1 1 -1 -1 1 


Fig. 5.23 Call within the organization block to be measured 
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LAST_RT indicates the runtime in microseconds of the last completed OB execution 
(examples @), @) and @). If OB_RT is called again in the organization block to be 
measured, -1 is output (example 0). The “net” runtimes are output; interrupt 
times caused by higher priority classes are not included in LAST_RT (example @). 


LAST_ET indicates the time period in microseconds between the start request and 
the end of processing for the last completed execution of the organization block to 
be measured (examples @) and @). This also applies for the first call of OB_RT in the 
organization block to be measured (@)). If OB_RT is called again in the organization 
block to be measured, -1 is output (example @)). LAST_ET also contains the inter- 
ruption times caused by program execution levels with higher priority (@). 


CUR_T indicates the relative time in microseconds (status of the counter in the op- 
erating system) of the OB start request, when - as in the following examples - 
OB_RT is called within the organization block to be measured. On completion of OB 
execution, CUR_T is set to zero. 


CUR_RT indicates the effective OB execution time until the call of OB_RT in micro- 
seconds. After completion of OB execution, the value in CUR_RT is transferred to 
LAST_RT and CUR _RT is set to zero. Interruption times caused by program execu- 
tion levels with higher priority are not included in CUR_RT (© and @) 


CUR_ET indicates the time period from the OB start request to calling of OB _RT in 
microseconds. After completion of OB execution, the value in CUR_ET is transferred 
to LAST_ET and CUR_ET is set to zero. CUR_ET also contains the interruption times 
caused by program execution levels with higher priority (@0). 


NEXT_RT indicates the time from the next subsequent OB start request to calling of 
OB_RT in microseconds if further, unprocessed start requests are pending. A CPU 
400 does not use the parameter NEXT_RT, the value is always -1. 


5.5.8 Runtime meter 


An runtime meter counts the hours while running. You can use the runtime meter, 
for example, to record the CPU runtime or to determine the operating hours of con- 
nected devices. 


The count value of a runtime meter is even retained during a buffered startup and 
after a general reset. 


A CPU 400 has 16 runtime meters with a value range of 32 bits (2?!-1 hours). The 
runtime meter also stops when the CPU is at STOP or HOLD; if the CPU restarts, the 
runtime meter counter must be restarted if required. 


If the maximum duration has been reached, the runtime meter remains stationary 
and signals an overflow. A runtime meter can only be set to a new value or zero us- 
ing an SFC call. 


RTM Control runtime meter 


The system function RTM controls a runtime meter. Fig. 5.24 shows the graphic 
representation of the system function. 
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5 Program execution 


Control runtime meter 


SFC 101 

contol runnme RTM: Job identification MODE 

meter 

RTM B#16#00 Read actual values CQ and CV 
B#16#01 Start with the last value 
— NR RET VAL — B#16#02 Stop 
= B#16#04 Set to default value 

—— MODE cQ — B#16#05 Set to default value and start 
—e cv — B#16#06 Set to default value and stop 


Fig. 5.24 System block for controlling the runtime meter 


RTM controls the runtime meter in 32-bit mode whose number is specified in the 
NR parameter. The MODE parameter defines the function to be executed. The value 
to which the runtime meter is to be set (default value or start value in hours) is 
present in the PV parameter. The CQ parameter signals with signal state “1” if the 
runtime meter is running. The current value in hours is present in the CV parame- 
ter. CQ and CV are updated by the job ID MODE = B#16#00. 


RTM replaces the system functions SET_RTM (SFC 2), CTRL_RTM (SFC 3) and 
READ_RTM (SFC 4), which control the 32-bit runtime meter in 16-bit mode. 


5.6 Interrupt processing 


5.6.1 Introduction to interrupt processing 


Interrupt processing is event-driven program execution. When such an event 
occurs, the operating system interrupts execution of the main program and calls 
the routine allocated to this particular event. Once this routine has been processed, 
the operating system resumes execution of the main program at the point of inter- 
ruption. Such an interruption can take place after every operation (statement). 


Applicable events may be interrupts and errors. A priority scheduler controls the 
execution order if interrupt events occur virtually simultaneously. 


Each routine associated with an interrupt event is written in an organization block 
in which further blocks can be called. An event of higher priority interrupts execu- 
tion of the routine in an organization block with a lower priority. You can influence 
the interruption of a program by events of higher priority using system blocks 
(Chapter 5.7.6 “Disable, delay, and enable interrupts and asynchronous errors” on 
page 224). 


Events 


The response of the operating system is based on events. If an organization block 
is assigned to the event, the block is called when the event occurs. If calling is not 
possible at this moment, the event is placed in the queue that corresponds to its pri- 
ority. 
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5.6 Interrupt processing 


If no organization block is assigned to an event, the preset system response is car- 
ried out when the event occurs: The operating system either calls the organization 
block OB 85 or changes to the STOP operating state. 


Current start and interrupt information 


Every organization block contains information concerning the start event in the 
first 20 bytes of the temporary local data. A detailed description of the start infor- 
mation can be found in Chapter 4.8 “Start information” on page 141. 


In many cases the interrupt-triggering component provides additional information 
which you can read in the interrupt organization block with the system function 
block RALRM (see Chapter 5.6.9 “Reading additional interrupt information” on 
page 212). 


Current signal states 


In an interrupt routine it is sometimes necessary to work with the current signal 
states of the I/O modules and not with the signal states of the inputs that were 
updated at the start of the main program. The fetched signal states are then written 
directly to the I/O without waiting until the output process image has been updated 
at the end of the main program. 


The operand area I/O permits direct access to the signal states on the module termi- 
nals. Note that the signal states on the module terminals change asynchronous to 
the cyclic program execution. It is therefore recommendable to maintain a strict 
separation between the main program and the interrupt routine. 


5.6.2 Priority classes 


Table 5.4 shows the organization blocks present with SIMATIC S7-400 with their ex- 
ecution priority. For a CPU 400, the execution priority can be adjusted for some or- 
ganization blocks. An organization block with a higher priority interrupts the pro- 
gram in an organization block with a lower priority. If you set the priority to 0 (ze- 
ro), the organization block is “deselected” and is not called up. 


The background program has the lowest execution priority (priority 0.29) and can 
be interrupted by all other OB start events (also by the main program). 


The main program can be interrupted by all alarm or error events. The start-up rou- 
tine is present in the organization blocks OB 100 (warm restart), OB 101 (hot re- 
start), and OB 102 (cold restart) and has priority 27. Asynchronous errors (OB 80 to 
88) occurring during the startup belong to priority class 28. 


If the start events happen and the corresponding organization block is not present, 
the CPU calls OB 85 Program execution error or switches to STOP. 


Temporary local data for a priority class 


Each organization block and thus each priority class requires temporary local data 
for the program execution. Each organization block saves its start information in 
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Table 5.4 Organization blocks available with the standard controllers of S7-400 


OB Priority Start event Standard name Available on CPU 
No. 
N T+ wo n 
Default | Variable pe ||| peta || er | | he 
1 1 no Start of main program Xx Xx x x 
10 2 0, 2 to 24 | Time-of-day interrupt x x x x 
11 x x x x 
12 x x x 
13 x x x 
14 x x 
15 x x 
16 x x 
17 x x 
20 3 0, 2 to 24 | Time-delay interrupt x x x x 
21 4 x x x x 
22 e) x x x 
23 6 T3 x x x 
30 7 0, 2 to 24 | Cyclic interrupt CYC_INTO x Xx 
31 8 CYC_INT1 x x 
32 9 CYC_INT2 x x x x 
33 10 CYC_INT3 x x x 
34 11 CYC_INT4 x x x 
35 12 CYC_INTS x x x x 
36 13 CYC_INT6 x x 
37 14 CYC_INT7 x x 
38 15 CYC_INT8 x x 
40 16 0, 2 to 24 | Hardware interrupt HW_INTO x x x x 
41 17 HW_INT1 x x x x 
42 18 HW_INT2 x x x 
43 19 HW_INT3 x x x 
44 20 HW_INT4 x x 
45 21 HW_INT5 x x 
46 22 HW_INT6 x x 
47 23 HW_INT7 x x 
55 Z 0, 2 to 24 | Status interrupt DP: STATUS ALARM x x x x 
56 Update interrupt DP: UPDATE ALARM x x x x 
57 Manufacturer-specific DP: MANUFACTURE ALARM | x x x x 
interrupt 
60 oS no Multiprocessor interrupt MULTL_INT x x x x 
61 a5 0, 2 to 24 | Synchronous cycle inter- SYNC_1 x x x x 
62 rupt SYNC_2 x x x x 
63 SYNC_3 x x x 
64 SYNC_4 x x 
80 | 26*) no Time error CYCL_FLT x x x x 
81 25°") 2 to 26 Power supply error PS_FLT x x x x 
$2) 25%) 2 to 26 Diagnostic interrupt /O_FLT1 x x * x 
83 25 *) 2 to 26 Insert/remove module /O_FLT2 x x x x 
interrupt 
84] 25*) 2to26 | CPU hardware fault PU_FLT x |x | x | x 
85 25%) 24 to26 Program execution error OBNL_FLT x x x x 
86 | 25*) 2to 26 | Rack failure RACK_FLT x | x | x | x 
87 | 25*) 2to26 | Communication error COMM_FLT x | x | x | x 
88 28 no Processing interrupt BREAKUP ERROR x x x x 
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Table 5.4 Organization blocks available with the standard controllers of S7-400 


OB Priority Start event Standard name Available on CPU 
No. 
nN} st] o]tn 
Default | Variable Rarta||| Spa] Cae | ae 
90 0,29 no Background program BACKGROUND x x x x 
100 27 no Restart (warm restart) COMPLETE RESTART x x x x 
101 Hot restart RESTART x x x x 
102 Cold restart COLD RESTART x x x x 
121 **) Synchronous error PROG_ERR x x x x 
122 I/O access error MOD_ERR x x x x 
*) The priority is 28 in the STARTUP operating state 
**) This error OB has the priority of the error-causing OB 


the temporary local data so that the local data area must have a minimum size of 20 
bytes. Since both the program editor and the user program require temporary local 
data, for example for the parameter transfer at block calls, a sufficiently large mem- 
ory capacity must be reserved (see Chapter 4.1.5 “Operand area temporary local da- 
ta” on page 94). 


The memory capacity approved for the temporary local data for a priority class can 
be set in the CPU properties under the Memory group. If you set zero bytes, the re- 
spective priority class is deactivated. 


5.6.3 Time-of-day interrupts, organization blocks OB 10 to OB 17 


You use a time-of-day interrupt if you wish to execute a program once at a particular 
time or periodically, for example daily. For S7-400, the organization blocks OB 10 to 
OB 17 are set aside for processing a time-of-day interrupt. 


You can configure a time-of-day interrupt in the hardware configuration or control 
it from the program during runtime using system functions. A prerequisite for cor- 
rect execution of the time-of-day interrupt is a correctly set real-time clock on the 
CPU. 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of OB 10 to OB 17 contains the tag 


OBxx_PERIOD_EXE Processing interval 


xx stands for the OB number. The processing interval specifies the interval with 
which the organization block is processed (see PERIOD parameter of the system 
function SET_TINT further below). 
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Using the time-of-day interrupt 


To start a time-of-day interrupt, you must first set the start time and then activate 
the time-of-day interrupt. You can carry out both activities separately using HW 
Config or also with system functions. Note that activation with HW Config means 
that the time-of-day interrupt is automatically started following parameterization 
of the CPU. 


You can start a time-of-day interrupt once or periodically. The time-of-day interrupt 
is canceled following a single call of the time-of-day interrupt OB. You can also can- 
cel an active time-of-day interrupt using CAN_TINT. If you wish to reuse a canceled 
time-of-day interrupt, you must set the start time again and activate the time-of- 
day interrupt. 


You can query the status of a time-of-day interrupt with QRY_TINT. 


Configuring the time-of-day interrupt 


A time-of-day interrupt is configured in the CPU properties in the group Interrupts. 
Activate the time-of-day interrupt on the Time-of-day interrupts tab, set the Priority 
if applicable, and select the processing interval from a drop-down list in the Execute 
dialog. Under Start time you can enter the time of the first execution. You can assign 
a process image partition to a time-of-day interrupt. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a time-of-day interrupt is assigned, in the CPU properties under 
Memory. 


System functions for processing a time-of-day interrupt 


You can use system functions to set, cancel, and activate a time-of-day interrupt and 
also to query the status. You can find the functions for the time-of-day interrupt in 
the program elements catalog under Extended instructions > Interrupts. Fig. 5.25 
shows the graphic representation of the system functions. 


SET_TINT determines the start time for a time-of-day interrupt. SET_TINT only sets 
the start time; the time-of-day interrupt must be activated by ACT_TINT in order to 
start the time-of-day interrupt OB. The start time is present in the SDT parameter in 
the format DATE_AND_TIME, e.g. DT#2011-01-01-08:30. The operating system ig- 
nores any specified seconds and milliseconds and sets these values to zero. For a 
monthly interval, only days 1 through 28 are possible start dates. When setting the 
start time, any old value of the start time is overwritten. A current time-of-day in- 
terrupt is canceled, i.e. the time-of-day interrupt must be activated again. 


CAN_TINT deletes a set start time and thus deactivates a time-of-day interrupt. The 
time-of-day interrupt OB is no longer called. If you wish to reuse this time-of-day 
interrupt, you must first set the start time again and then activate the time-of-day 
interrupt. 


ACT_TINT activates a time-of-day interrupt. Activation is only possible if a time has 
been set for the time-of-day interrupt. ACT_TINT signals an error if the start time 
for a single start is in the past. In the case of a periodic start, the operating system 
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Control time-of-day interrupt 


SFC 28 
Set time-of-day interrupt 


SET_TINT SET_TINT: Assignment of PERIOD parameter 
— OB NR RET VAL — 16#0000 Single 16#1201 Weekly 
am i 16#0201 Everyminute 16#1401 Monthly 
— Spt 16#0401 Hourly 16#1801 Annually 
— PERIOD 16#1001 Daily 16#2001 Last day of month 
SFC 29 SFC 30 SFC 31 
Cancel time-of-day interrupt Activate time-of-day Interrupt Query time-of-day interrupt 
CAN_TINT ACT_TINT QRY_TINT 
— OB_NR RET. VAL—- — OBNR RET VAL——- — OB_NR RET_VAL — 
STATUS —— 


Fig. 5.25 System blocks for controlling the time-of-day interrupt 


calls the time-of-day interrupt OB at the next due time. A single time-of-day inter- 
rupt is quasi deleted following processing; you can set and activate it again (at a dif- 
ferent start time). 


QRY_TINT provides information on the status of a time-of-day interrupt. The 
STATUS parameter contains the desired information and the individual bits have 
the significance shown in Table 5.5. 


Table 5.5 STATUS parameter of system function QRY_TINT 


Bit Meaning with signal state “0” Meaning with signal state “1” 

0 The CPU is in RUN. The CPU is in STARTUP. 

1 The interrupt is enabled. The interrupt has been disabled by DIS_IRT. 
2 The interrupt is not active or has expired. The interrupt is active. 

3 Always “0” 

4 An OB with the number OB_NR does not exist. An OB with the number OB_NR is loaded. 
Other Always “0” 


Behavior during startup 


During a warm restart or a cold restart, the operating system deletes all settings 
you have made using a system function. The settings parameterized with the hard- 
ware configuration are retained. For a hot restart, the CPU continues the processing 
of the time-of-day interrupts in the first complete cycle of the main program. 
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You can obtain information in the startup program on the status of a time-of-day 
interrupt using QRY_TINT and cancel or reset and activate the time-of-day interrupt 
as required. Processing of a time-of-day interrupt OB only takes place in the RUN 
operating state. 


Error response 


If the time-of-day interrupt OB is missing in the user program when called, the op- 
erating system calls the organization block OB 85 Program execution error. If OB 85 
is not present, the CPU switches to STOP. 


A time-of-day interrupt whose priority class has been deselected in the CPU proper- 
ties cannot be executed even if the corresponding organization block is present. 
The CPU then switches to STOP. 


A time-of-day interrupt which has been deactivated by parameterization of the CPU 
cannot be executed even if the time-of-day interrupt OB is present. The CPU then 
switches to STOP. 


If you activate the time-of-day interrupt for single processing and if the start time 
(from the viewpoint of the real-time clock) is in the past, the operating system calls 
the organization block OB 80 Time error. If this is not present, the CPU switches to 
STOP. 


If you activate the time-of-day interrupt for periodic processing and if the start time 
(from the viewpoint of the real-time clock) is in the past, the time-of-day interrupt OB 
is processed at the next due time. 


If you advance the real-time clock by more than approximately 20 s, either through 
a correction or synchronization, such that the start time for the time-of-day inter- 
rupt OB is bypassed, the operating system calls the organizational block OB 80 Time 
error. The time-of-day interrupt OB is subsequently processed once. 


If you have set the real-time clock back by more than approximately 20 s, either 
through a correction or synchronization, an activated time-of-day interrupt OB at 
the points in time which have already passed is no longer processed. 


If a time-of-day interrupt OB is still being processed and the next (periodic) call al- 
ready occurs, the operating system calls the organization block OB 80 Time error. 
Following processing of the OB 80 and the time-of-day interrupt OB, the time-of-day 
interrupt OB is started again. 


5.6.4 Time-delay interrupts, organization blocks OB 20 to OB 23 


A time-delay interrupt allows you to implement a delay time independent of the 
timer functions and asynchronous to cyclic program execution. With a CPU 400, the 
organization blocks OB 20 to OB 23 are set aside for processing a time-delay inter- 
rupt. 
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Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the time-delay interrupt OB contains the tags 


OBxx_SIGN Job ID 
OBxx_DTIME Parameterized delay time 
xx stands for the OB number. The OBxx_SIGN tag contains the job ID which you 


have parameterized in the SIGN parameter of system function SRT_DINT. The 
OBxx_DTIME tag contains the delay time in ms. 


Using time-delay interrupts 


A time-delay interrupt is activated by calling SRT_DINT; this also passes on the delay 
interval and the delay organization block. When the delay interval has expired, the 
corresponding organization block is called. You can query the status of a time-delay 
interrupt with QRY_DINT. 


You can also use CAN_DINT to cancel execution of a time-delay interrupt that has 
not yet started. The associated organization block is then no longer called. 


Configuring a time-delay interrupt 


A time-delay interrupt is configured in the CPU properties in the group Interrupts. 
On the Time-delay interrupt tab, activate a time-delay interrupt by setting a priority 
other than zero. You can assign a process image partition to a time-delay interrupt. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a time-delay interrupt is assigned, in the CPU properties under Mem- 


ory. 


System functions for time-delay interrupts 


You can use system functions to activate and cancel a time-delay interrupt and also 
to query the status. You can find the functions for the time-delay interrupts in the 
program elements catalog under Extended instructions > Interrupts. Fig. 5.26 shows 
the graphic representation of the system functions. 


Control time-delay interrupt 


SFC 32 SFC 33 SFC 34 
Start time-delay Cancel time-delay Query time-delay 
interrupt interrupt interrupt 
SRT_DINT CAN_DINT QRY_DINT 
—  OB_NR RET VAL—- — OB.NR RET VAL—- —OB_NR RET_VAL — 
— D_TIMR STATUS —— 
— SIGN 


Fig. 5.26 Start, cancel, and query a time-delay interrupt 
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SRT_DINT activates a time-delay interrupt. The call is simultaneously the start time 
for the parameterized period. Once the delay time has expired, the CPU calls the pa- 
rameterized OB and transfers the delay time value and a job ID in the start informa- 
tion for this OB. You define the job ID in the SIGN parameter; you can read the same 
value in bytes 6 and 7 of the start information of the associated time-delay interrupt 
OB. You can set the delay time in intervals of 1 ms. The accuracy of the delay time is 
also 1 ms. 


Note that processing of the time-delay interrupt OB may be delayed if organization 
blocks of higher priority are being processed when the OB is called. You can over- 
write a current delay time by a new value by calling SRT_DINT again. The new delay 
time then commences when called. 


CAN_DINT cancels an activated time-delay interrupt. The parameterized organiza- 
tion block is not called in this case. 


QRY_DINT provides information on the status of the time-delay interrupt. You 
select the time-delay interrupt using the OB number. The STATUS parameter con- 
tains the desired information and the individual bits have the significance shown 
in Table 5.6. 


Table 5.6 STATUS parameter of system function QRY_DINT 


Bit Meaning with signal state “0” Meaning with signal state “1” 

ie) The CPU is in RUN. The CPU is in STARTUP. 

1 The interrupt is enabled. The interrupt has been disabled by DIS_IRT. 
2 The interrupt is not active or has expired. The interrupt is active. 

3 Always “0” 

4 An OB with the number OB_NR does not exist. An OB with the number OB_NR is loaded. 
Other Always “0” 


Behavior during startup 


During a warm restart or cold restart, the operating system deletes all settings you 
have programmed for time-delay interrupts. For a hot restart, the settings are re- 
tained until the execution in RUN mode, where the “remaining cycle” is considered 
part of the STARTUP mode. 


You can start a time-delay interrupt in the startup program by calling SRT_DINT. 
Following expiry of the delay time, the CPU must be in the RUN operating state in 
order to process the corresponding organization block. If this is not the case, the 
CPU waits with the OB call until the startup has been completed and then calls the 
time-delay interrupt OB before the first statement in the main program. 
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Error response 


If the time-delay interrupt OB is missing in the user program when called, the 
operating system calls the organization block OB 85 Program execution error. If 
OB 85 is not present, the CPU switches to STOP. 


If the delay time has expired and the associated OB is still being processed, the oper- 
ating system calls the organization block OB 80 Time error or enters the STOP oper- 
ating state if the OB 80 is not present. 


A time-delay interrupt whose priority class has been deselected in the CPU proper- 
ties cannot be executed even if the corresponding organization block is present. 
The CPU then switches to STOP. 


5.6.5 Cyclic interrupts, organization blocks OB 30 to OB 38 


A cyclic interrupt is an interrupt triggered at periodic intervals and initiates execu- 
tion of a cyclic interrupt organization block. A cyclic interrupt allows you to period- 
ically execute a particular routine independent of the processing time of the cyclic 
program. With a CPU 400, organization blocks OB 32 to OB 38 are set aside for pro- 
cessing the cyclic interrupts. 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the cyclic interrupt OB contains the tags 


OBxx_PHASE OFFSET Phase offset 


OBxx_EXC_FREQ Parameterized time interval 


xx stands for the OB number. If the OBxx_STRT_INF tag has the value B#16#3A, the 
phase shift and the time interval are output in microseconds (is), otherwise in mil- 
liseconds (ms). 


Phase offset 


You can use the phase offset to process cyclic interrupt programs in a precise time 
frame even if they have the same time interval or a common multiple thereof. This 
results in higher accuracy of the processing intervals. 


The start time of the time interval and the phase offset is the transition from the 
STARTUP operating state to RUN. The call instant for a cyclic interrupt OB is thus the 
time interval plus the phase offset. An example is shown in Fig. 5.27. No phase off- 
set is set in the left section, and consequently start of processing of the lower prior- 
ity organization block is delayed by the current processing time of the higher pri- 
ority organization block in each case. 


If, on the other hand, a phase shift is configured and it is greater than the maximum 
processing time of the higher-priority organization block, the lower-priority orga- 
nization block is processed in the precise time frame. 
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Effect of phase offset with cyclic interrupts 


RUN Without phase offset With phase offset 


fe lg ole Pane 


Processing 
of high- 
priority OB 


Processing 
of low- 
priority OB 


Phase offset 
Starting of the low-priority OB is shifted by _If the phase offset is sufficiently large, 


the processing time of the high-priority OB. _ the low-priority OB starts exactly in the 
time interval. 


Fig. 5.27 Processing of cyclic interrupts with and without phase offset 


Time interval 


You can configure each cyclic interrupt OB in a range from 500 us (1 ps for CPU 417) 
to 6s with a time scale of 1 ps. Table 5.7 shows the default settings for the cyclic in- 
terrupt organization blocks. 


Table 5.7 Default setting for cyclic interrupts 


Organization block Time interval | Phase offset Priority 
OB 30 5s Oms 7 
OB 31 2s Oms 8 
OB 32 1s Oms 9 
OB 33 500 ms Oms 10 
OB 34 200 ms Oms 11 
OB 35 100 ms Oms 12 
OB 36 50 ms Oms 13 
OB 37 20 ms Oms 14 
OB 38 10 ms Oms 15 


Configuring a cyclic interrupt 


Acyclic interrupt is configured in the CPU properties in the group Interrupts. On the 
Cyclic interrupts tab, activate a time-of-day interrupt by setting a priority other than 
zero. Select the unit of time (ms, ps) and set the time interval (in the Execution col- 
umn) and, if applicable, the phase offset. You can assign a process image partition 
to a cyclic interrupt. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a cyclic interrupt is assigned, in the CPU properties under Memory. 


Behavior during startup 


Processing of cyclic interrupts is not possible in the startup program. The time in- 
tervals only commence upon transition to the RUN operating state. 
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Error response 


If the associated cyclic interrupt is repeated during an ongoing cyclic interrupt OB, 
the operating system calls the organization block OB 80 Time error. The cyclic inter- 
rupt that caused the error is executed later. 


If OB 80 is not present, the CPU switches to STOP. 


5.6.6 Hardware interrupts, organization blocks OB 40 to OB 47 


You use a hardware interrupt to allow immediate detection in the user program of 
an event in the controlled process, making it possible to respond with an appropri- 
ate routine. With a CPU 400, the organization blocks OB 40 to OB 47 are set aside 
for processing a hardware interrupt. 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of a hardware interrupt OB contains the tags 


OBxx_IO_FLAG I/O identifier 
OBxx_MDL_ADDR Module start address 
OBxx_POINT_ADDR Interrupt information 


xx stands for the OB number. With this information you can identify the component 
triggering the interrupt. The OBxx_IO_ FLAG tag identifies with B#16#54 an input 
module, and with B#16#55 an output module. The module start address is con- 
tained in the OBxx_ADL_ADDR tag. OBxx_POINT_ADDR identifies in a bit array 
which channel of the module has triggered the hardware interrupt. 


Enabling hardware interrupts 


A hardware interrupt is enabled on a module designed for this. This can be, for 
example, a digital input module which records a signal coming from the process, or 
a function module which triggers a hardware interrupt due to a process on the 
module. 


Activation of a hardware interrupt is initially disabled by default. You enable pro- 
cessing of the hardware interrupt in the parameterization (static parameter). You 
can select whether the hardware interrupt is to be triggered by an incoming event, 
an outgoing event, or by both (dynamic parameter). You can change dynamic pa- 
rameters during runtime by calling a function. 


In a PROFIBUS DP master system, an intelligent DP slave can trigger a hardware in- 
terrupt in the master CPU by means of the system function DP_PRAL. The interrupt 
ID which you pass on in the AL_INFO parameter to the DP_PRAL function is present 
in the start information in the OBxx_POINT_ADDR tag. 


The module acknowledges the hardware interrupt following processing of the 
organization block belonging to the hardware interrupt. 
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Detecting hardware interrupts 


If, during processing of a hardware interrupt OB, an event occurs on the same chan- 
nel of the same module which would retrigger the freshly processed hardware in- 
terrupt, this hardware interrupt is lost. If the event occurs on a different channel of 
the same module or on a different module, the operating system restarts after pro- 
cessing of the hardware interrupt OB. 


Configuring a hardware interrupt 


A hardware interrupt is configured in the CPU properties in the group Interrupts. 
On the Hardware interrupts tab, activate a hardware interrupt by setting a priority 
other than zero. You can assign a process image partition to a hardware interrupt. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a hardware interrupt is assigned, in the CPU properties under Mem- 
ory. 


Behavior during startup 


The modules do not generate hardware interrupt events in the startup program. 
Interrupt processing commences with the transition to the RUN operating state. 
Hardware interrupts present during the transition are lost. 


Error handling 


If the hardware interrupt OB is missing in the user program when the hardware 
interrupt event occurs, the operating system calls the organization block OB 85 
Program execution error. The hardware interrupt is acknowledged. If OB 85 is not 
present, the CPU switches to STOP. 


A hardware interrupt whose priority class has been deselected in the CPU proper- 
ties cannot be executed even if the assigned organization block is present. The CPU 
then switches to STOP. 


5.6.7 Interrupts for DPV1 organization blocks OB 55 to OB 57 


PROFIBUS DPV1 slaves (PROFIBUS) and correspondingly designed IO devices 
(PROFINET IO) can trigger the following interrupts: 


> Status interrupt if, for example, the station changes its operating state; the inter- 
rupt organization block OB 55 is called. 


> Update interrupt if, for example, the station parameters are changed over the 
bus system or directly; the interrupt organization block OB 56 is called. 


> Vendor-specific interrupt if an event envisaged for this by the manufacturer 
occurs; the interrupt organization block OB 57 is called. The events triggering 
the interrupt are defined by the station manufacturer. 


The DPV1 interrupt is deactivated by default. You can activate a DPV1 interrupt with 
the hardware configuration on the corresponding DPV1 slave or IO device. 
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Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the DPV1 interrupt OBs contains further tags in the area 
from byte 5 to byte 11 which identify the components triggering the interrupts. The 
assignment and occupation of the tags depends on the bus system used (PROFIBUS 
or PROFINET) (see operating instructions). 


The additional interrupt information can be read using the system function block 
RALRM (see Chapter 5.6.9 “Reading additional interrupt information” on page 212). 


Configuring a DPV1 interrupt 


ADPV1 interrupt is configured in the CPU properties in the group Interrupts. On the 
Interrupts for DPV1 tab, activate the DPV1 interrupt by setting a priority other than 
zero. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a DPV1 interrupt is assigned, in the CPU properties under Memory. 


Behavior in the STOP and STARTUP operating states 


Distributed I/O stations can also generate interrupts even if the central CPU is in the 
STOP or STARTUP operating state. The CPU cannot call or process interrupt organi- 
zation blocks when at STOP; processing of the interrupts is not carried out later ei- 
ther when the CPU goes to RUN. DPV1 interrupts occurring in the STARTUP operat- 
ing state are processed in the transition from STOP to RUN. 


The received interrupt events are entered into the diagnostic buffer and into the 
module status data both at STOP and STARTUP. You can read the module status data 
with the system function RDSYSST. 


Error handling 


If the corresponding DPV1 interrupt OB is missing in the user program when the 
DPV1 interrupt is triggered, the operating system calls the organization block OB 85 
Program execution error. The DPV1 interrupt is acknowledged. If OB 85 is not present, 
the CPU switches to STOP. 


A DPV1 interrupt whose priority class has been deselected in the CPU properties 
cannot be executed even if the assigned organization block is present. The CPU then 
switches to STOP. 


5.6.8 Synchronous cycle interrupts, organization blocks OB 61 to OB 64 


The “Isochronous mode” function permits synchronous input, processing, and out- 
put of I/O signals in a fixed (equidistant) time pattern. The user program executed 
in isochronous mode is present in one of the organization blocks OB 61 to OB 64. 
The system functions SYNC_PI and SYNC_PO are available for isochronous updat- 
ing of the process image. 


209 


5 Program execution 


A synchronous cycle interrupt is triggered by theGlobal_Contro] command of a DP 
master. Isochronous processing is described in Chapter 16.4.5 “Special functions 
for PROFIBUS DP” in the section “Configuring equidistant bus cycles (constant bus 
cycle time) and isochronous mode” on page 662. 


Start information 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of a synchronous cycle interrupt OB contains the tags 


OBxx_GC_VIOL GC violation 

OBxx_FIRST First execution following STARTUP or HOLD 
OBxx_MISSED_EXEC Number of discarded OB calls 

OBxx_DP_ID Master system ID 


xx stands for the OB number. The OBxx_GC_VIOL and OBxx_MISSED_EXEC tags al- 
low you to recognize faulty isochronous processing. Default settings can be pro- 
grammed in the first cycle identified by the OBxx_FIRST tag. The OBxx_DP_ID tag in- 
dicates the master system from which the synchronous cycle interrupt OB has been 
called. 


Configuring isochronous mode interrupts 


To activate a synchronous cycle interrupt, set a priority other than zero and the 
number of the DP master system in the properties of the DP master CPU under In- 
terrupts> Synchronous cycle interrupts. A prerequisite is that a DP master system is 
already present. In the Process image partition(s) column, assign one or more pro- 
cess image partitions to the synchronous cyclic interrupt. 


Sufficient memory space for the temporary local data must be assigned to a priority 
class, to which a synchronous cyclic interrupt is assigned, in the CPU properties un- 
der Memory. 


To carry out interrupt processing, add the synchronous cycle interrupt OB to the us- 
er program in the Program blocks folder. In the OB, call the system function SYNC_- 
PI prior to the interrupt routine and the system function SYNC_PO after the inter- 
rupt routine. These functions update the process image partition of those inputs 
and outputs you are using in the interrupt routine. When configuring these mod- 
ules, you must apply their addresses to the process image partition that is assigned 
to the synchronous cyclic interrupt OB. 


Caution: In the interrupt routine itself you may only work with the inputs and outputs 
of the process image partition. Direct access to the I/O addresses assigned to the 
process image partition is not permissible! 


System functions for the isochronous mode interrupt 


You can use system functions to update the used process image partition in the pro- 
gram of asynchronous cycle interrupt OB. Fig. 5.28 shows the graphic representa- 
tion of the system functions. 
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Isochronous updating of process image partitions 


SFC 126 SFC 127 
Updating of the process Updating of the process 
image input partition image output partition 
SYNC _PI SYNC_PO 
— PART RET VAL —- —— PART RET_VAL —— 
FLADDR —— FLADDR —— 


Fig. 5.28 System blocks for isochronous updating of process image partitions 


The system function SYNC_PI updates the process image partition TPA1 of the in- 
puts. The system function SYNC_PO updates the process image partition TPA1 of 
the outputs. Updating is carried out isochronously and data-consistent. The two 
system functions may only be called in the synchronous cycle interrupt OB. In the 
PART parameter you define the process image partition to be updated. 


The process image partitions are not updated if an error is detected. Exceptions: 


> If an access error occurs when updating the process image input partition, the 
inputs of faulty modules are set to signal state “O”; and the OB 85 Program execu- 
tion error is not called. 


> A consistency warning is output if the complete data could not be transferred 
consistently to the outputs. However, the data of individual slaves are consistent. 


> Ifan access error occurs during updating of the process image output partition, 
the data of the faulty modules is not transferred; it remains unchanged in the 
process image partition. The updating of unaffected modules is divided between 
two DP cycles (with consistency warning). 


Behavior in the STOP, HOLD, and STARTUP operating states 


A synchronous cycle interrupt is only processed in the RUN operating state. A syn- 
chronous cycle interrupt in the STOP, HOLD or STARTUP operating states is reject- 
ed. The number of OB calls which have not been executed is indicated in the start 
information of the synchronous cycle interrupt OB called for the first time in RUN. 


Error handling 


If a isochronous mode interrupt arrives before the associated isochronous mode in- 
terrupt OB has been completed, the organization block OB 80 Time error is called. 
This can happen if the user program in a isochronous mode interrupt OB takes too 
long or if processing has been interrupted for too long because of higher-priority 
program parts. The OB requested by the “too early” interrupt is rejected and the OB 
80 Time error is called. Here it is then possible to respond to the time error. The num- 
ber of failed isochronous mode interrupts is output in the start information of the 
next isochronous mode interrupt OB processed. 
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In the event of an error, the DP master can omit the Global_Control (GC) command 
or send it offset. This “GC violation” is shown in the start information of the next iso- 
chronous mode interrupt OB which is called correctly. 


A synchronous cycle interrupt whose priority class has been deselected in the CPU 
properties cannot be executed even if the assigned organization block is present. 
The CPU then switches to STOP. 


5.6.9 Reading additional interrupt information 


The system block RALRM reads additional interrupt information from the inter- 
rupt-triggering components (modules or submodules). It is called in an interrupt 
organization block or in a block called within this. Processing of RALRM is synchro- 
nous, i.e. the requested data is available at the output parameters immediately fol- 
lowing the call. Fig. 5.29 shows the graphic representation of RALRM. 


Read additional interrupt information 


SFB 54 
Read additional interrupt 
information 


Inst dat 
nstance Gata RALRM: Assignment of MODE parameter 


fare 0 Indicates the interrupt-triggering component in the 
— MODE NEW — ID parameter, and sets NEW to the signal state "1". 
—FID STATUS — 1 Describes all output parameters of RALRM. 
— MLEN iD — 2 Checks whether the component specified in the 
F_ID parameter has triggered the interrupt; if not, NEW is 
— TINFO LEN —— set to signal state "0", otherwise to signal state "1" and all 
— AINFO output parameters are written. 


Fig. 5.29 System block for reading additional interrupt information 


RALRM can always be called in all organization blocks or execution levels for all 
events. Call it in an organization block whose start event is not an interrupt from 
the I/O, correspondingly less information is available. Different information is 
entered in the destination areas specified by the TINFO and AINFO parameters 
depending on the respective organization block and the interrupt-triggering com- 
ponent. 


In bytes 0 to 19, the destination area TINFO (task information) contains the com- 
plete start information of the organization block in which RALRM was called, inde- 
pendent of the nesting depth in which it was called. The system block RALRM thus 
partially replaces the system function RD_SINFO. Management information is pres- 
ent in bytes 20 to 27, e.g. which component has triggered the interrupt. 


In bytes 0 to 3 (bytes 0 to 25 with PROFINET), the destination area AINFO (alarm 
information) contains the header information, e.g. the number of received bytes 
of the additional interrupt information or interrupt type. Bytes 4 to 223 (bytes 26 
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to 1431 with PROFINET) contain the component-specific additional interrupt infor- 
mation itself. 


The assignment of the MODE parameter determines the mode of the system block 
RALRM. With Mode = 0, the system block shows you the interrupt-triggering compo- 
nent in the ID parameter; NEW is assigned TRUE. With Mode = 1, all output 
parameters are written. With Mode = 2, check whether the component specified by 
the F_ID parameter was the interrupt-triggering one. If this applies, the NEW param- 
eter has the value TRUE, and all other output parameters are written. 


In order to work correctly, RALRM requires separate instance data for each call in 
the various organization blocks, e.g. a separate instance data block in each case. 


5.7 Error handling 


5.7.1 Causes of errors and error responses 


The CPU can detect and signal errors in the program execution and from the mod- 
ules. These errors include: 


> Error in arithmetic operations (overflow, invalid REAL number) with setting 
of the status bits, e.g. status bit OV with number range overflow 


> Error during execution of the user program (synchronous error) with calling 
of organization blocks OB 121 and OB 122 


> Error in automation system independent of program execution (asynchronous 
error) with calling of organization blocks OB 80 to OB 88. 


The occurrence of an error and possibly the reason are indicated by error LEDs on 
the front panel of the CPU. In the event of serious errors, for example an impermis- 
sible operation code, the CPU is directly set to STOP. 


The system diagnostics can detect errors on the modules and enters these errors 
into a diagnostic buffer. The diagnostic buffer also contains information on the 
mode transitions of the CPU, e.g. the reasons for STOP. 


5.7.2. Synchronous error 


The CPU's operating system generates a synchronous error event if an error occurs 
in direct relationship with the program execution. Two types of error are distin- 
guished: programming error and I/O access error. 


Programming error, organization block OB 121 


A programming error is present if program execution is faulty. This includes, for 
example, BCD conversion errors, errors with indirect addressing, addressing of 
missing SIMATIC timers, counters or blocks. Organization block OB 121 is called in 
the event of a programming error. 
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If the organization block OB 121 is not present when a programming error occurs, 
the CPU switches to STOP. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the programming error OB contains the 
tags 


OB121_SW_FLT Start request for OB 121 (error code) 

OB121_FLT_REG Error source depending on the error code 
OB121_ BLK TYPE _ Type of block in which the error occurred 
OB121_ BLK NUM Number of the block in which the error occurred 
OB121_RESERVED_1 Faulty operand area and type of access 

OB121_ PRG_ADDR _ Relative address of the machine code causing the error 


The error code is provided in the OB121_SW_FLT tag. Example: If the OB121_SW_FLT 
tag is occupied by B#16#32 (= access to a non-existent global data block), the 
OB121_LT_REG tag contains the number of the missing data block. 


I/O access error, organization block OB 122 


An I/O access error is present if a faulty module, a non-existent module, or an I/O 
address unknown on the CPU is accessed. The operating system responds different- 
ly depending on the type of access: 


> The I/O access takes place from the user program. The I/O access error organiza- 
tion block OB 122 is then called. 


> The PZF occurs during automatic updating of a process image (partition). As a 
default response for a CPU 400, an entry is made in the diagnostic buffer and the 
call of OB 85 takes place for each erroneous access (see “Program execution error 
OB 85” on page 221 in Chapter 5.7.5 “Asynchronous errors”). 


> The I/O access error occurs if a process image partition is updated by a system 
function. The error and address of the first error-signaling byte are returned via 
their parameters (UPDAT_PI and UPDAT_ PO, SYNC_PI and SYNC_PO). 


If an error occurs during updating of the process image input, the corresponding 
input bytes are set to zero until the error has been eliminated. If an I/O access error 
occurs during a write access to the peripheral outputs, a CPU 400 updates the pro- 
cess image output. 


A CPU 400 distinguishes between two types of I/O access errors: Access to an un- 
available module and erroneous access to a module that is entered as available 
(time-out). If a module fails during operation, this module is entered as “not avail- 
able” after approx. 150 ps when accessed so that an I/O access error (time-out) is re- 
ported for each further access. The CPU also reports an I/O access error if access is 
made to an unavailable module, whether it is directly via the IO area or indirectly 
via the process image 


If the organization block OB 122 is not present when a programming error occurs, 
the CPU switches to STOP. 
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In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the I/O access error OB contains the tags 


OB122 SW _FLT Start request for the OB 122 (error code) 

OB122 BLK_TYPE _ Type of block in which the error occurred 
OB122 BLK NUM Number of the block in which the error occurred 
OB122 MEM AREA Memory area (bits 0 to 3) and type of access (bits 4 to 7) 
OB122 MEM ADDR Memory address at which the error occurred 

OB122 PRG_ADDR _ Relative address of the machine code causing the error 


In the OB122_ SW_FLT tag, the value B#16#42 stands for a read operation and 
B#16#43 for a write operation. The type of access in the OB122_ MEM_AREA tag can 
be bit (with value 1), byte (2), word (3), and doubleword (4). The memory area can 
be the I/O area PI or PQ (with value 0), the process image input, (1) or the process 
image output (2). The error-causing memory address is then in the 
OB122 MEM_ADDR tag. 


Priority class, block nesting depth, and L stack 


Asynchronous error OB has the same priority (class) as the block which caused the 
error. The accumulators and address registers of the synchronous error OB contain 
the values which the error-causing block had at the break point. The data block 
registers are deleted and the indicator word is assigned undefined. 


It is similar with the block nesting depth. The nesting depth per priority class per- 
missible for a CPU is the total of the nesting depth of “normal” processing and the 
nesting depth of synchronous error processing. The additional block nesting depth 
in asynchronous error OB is 1 (CPU 412 and CPU 414) or 2 (CPU 416 and CPU 417). 


Note when calling a synchronous error OB that its 20 bytes of start information are 
additionally stored in the L stack of the error-causing priority class, as well as the 
further temporary local data of the synchronous error OBs and all blocks called in 
these OBs. The area reserved for the temporary local data must be designed for this 
in every priority class affected (program execution level) (can be set with a CPU 400 
in the CPU properties under Memory). 


5.7.3. Enabling and disabling synchronous error processing 


You can use system functions to disable calling of the error OB in the event of a syn- 
chronous error event, or enable it again, and also query which synchronous error 
events have occurred. Fig. 5.30 shows the graphic representation of the system 
functions. 


Error masks 


You use the error masks to control the system functions for handling synchronous 
errors. A bit is present in the programming error mask for each detected program- 
ming error, and in the access error mask for each detected access error. When spec- 
ifying the error mask, you set the bit which corresponds to the synchronous error 
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Handling of synchronous error events 


SFC 36 SFC 37 SFC 38 
Mask synchronous Unmask synchronous Read event status 
error events error events register 
MSK_FLT DMSK_FLT READ_ERR 
— PRGFLT_ RET. VAL—— —— PRGFLT_ RET. VAL—— —— PRGFLT_ RET_VAL — 
SET_MASK RESET_MASK QUERY 
— ACCFLT_ PRGFLT_ —- —— ACCFLT_ PRGFLT_ —- —— ACCFLT_ PRGFLT_ — 
SET_MASK MASKED RESET_MASK MASKED QUERY CLR 
ACCFLT_ — ACCFLT_ —— ACCFLT_ — 
MASKED MASKED CLR 


Fig. 5.30 System blocks for handling of synchronous error events 


you wish to mask, unmask, or query. The error masks returned by the system func- 
tions indicate the synchronous errors which are still masked or present by signal 
state “1”. 


The assignments of the access error mask are shown in Table 5.8, where the 
“Error code” column shows the assignment of the OB122_SW_FLT tag in the start 
information of OB 122. 


Table 5.8 Assignment of access error mask 


Bit | Error code Assignment 


2 BH16#42 IO access error when reading 
The module is not present or does not acknowledge 


3 BH16#43 I/O access error when writing 
The module is not present or does not acknowledge 


The assignments of the programming error mask are shown in Table 5.9. The Error 
code column shows the assignment of the OB121_SW_FLT tag in the start informa- 
tion of OB 121. The bits of the error masks not listed in the table are not relevant to 
the handling of synchronous errors. 


MSK FLT Mask synchronous error events 


By means of the error masks, the system function MSK_FLT disables calling of the 
synchronous error OBs. By means of signal state “1” you identify in the error masks 
for which synchronous errors the OBs are not to be called (the synchronous error 
events are “masked”). The specified masking is used in addition to the masking 
saved in the operating system. MSK_FLT signals in the function value whether a 
(saved) masking was already present (16#0001) for at least one bit for the masking 
specified in the input parameters. 


MSK_FLT returns all currently masked events with signal state “1” in the output pa- 
rameters. 
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Table 5.9 Assignment of programming error mask 


Bit | Error code Assignment 
1 B#16#21 BCD conversion error (pseudo tetrad during conversion) 
2 BH16#22 Area length error when reading (operand outside permissible range) 
3 B#16#23 Area length error when writing (operand outside permissible range) 
4 B#16#24 Area error when reading (incorrect area in area pointer) 
5 B#16#25 Area error when writing (incorrect area in area pointer) 
6 BH16#26 Faulty number of a timer function 
7 BH16#27 Faulty number of a counter function 
8 BH16#28 Address error when reading 
(bit address <>0 with byte, word or doubleword access with indirect addressing) 
g BH16#29 Address error when writing 
(bit address <>0 with byte, word or doubleword access with indirect addressing) 
16 B#16#30 Write error with global data block (read-only block) 
17 B#16#31 Write error with instance data block (read-only block) 
18 | BHI6#32 Faulty number of a global data block (DB register) 
19 B#16#33 Faulty number of an instance data block (DI register) 
20 | BHI16#34 Faulty number of a function FC 
21 | BH16#35 Faulty number of a function block FB 
26 | BHI16#3A Called data block DB does not exist 
28 | BHI6#3C Called function FC does not exist 
30 | BHI6#3E Called function block FB does not exist 


Ifa masked synchronous error event occurs, the corresponding OB is not called and 
the event is not entered in the event status register. Masking applies to the current 
priority class (program execution level). If you mask the call of asynchronous error 
OB in the main program, for example, the synchronous error OB is nevertheless 
called if the error occurs in an interrupt routine. 


DMSK_FLT Unmask synchronous error events 


By means of the error masks, the system function DMSK FLT enables calling of the 
synchronous error OBs. By means of signal state “1” you identify in the error masks 
the synchronous errors for which the OBs are to be called again (the synchronous 
error events are “unmasked”). The entries in the event status register correspond- 
ing to the specified unmasking are deleted. DMSK_FLT signals with W#16#0001 in 
the function value if no (saved) masking was present for at least one bit for the un- 
masking specified in the input parameters. 
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DMSK FLT returns all currently masked events with signal state “1” in the output 
parameters. 


Ifan unmasked synchronous error event occurs, the corresponding OB is called and 
the event is entered in the event status register. Unmasking applies to the current 
priority class (program execution level). 


READ ERR Read event status register 


The system function READ_ERR reads the event status register. With signal state “1” 
you identify in the error masks the synchronous errors for which you wish to read 
the entries. READ_ERR signals with W#16#0001 in the function value if no (saved) 
masking was present for at least one bit for the selection specified in the input 
parameters. 


READ _ERR returns the selected events with signal state “1” in the output parame- 
ters when they have occurred and deletes these events in the event status register 
when scanned. Synchronous errors which have occurred in the current priority 
class (program execution level) are signaled. 


5.7.4 Enter substitute value 


REPL_VAL is called in asynchronous error OB and enters a substitute value into ac- 
cumulator 1. Fig. 5.31 shows the graphic representation of the system function. 


Enter substitute value into accumulator 1 


SFC 44 
Enter substitute value 


REPL_VAL 


— BAe RET_VAL —— 


Fig. 5.31 System block for entering a substitute value 


You use REPL VAL if no value can be read from a module, for example because the 
module is defective. The OB 122 Access error is then called with each access opera- 
tion. The start information indicates which module has caused the error. You can 
then load a substitute value into accumulator 1 by calling REPL_VAL; program exe- 
cution is then continued with this substitute value. 


REPL_VAL may only be called in a synchronous error OB (OB 121 or OB 122) 


5.7.5 Asynchronous errors 


Asynchronous errors are errors which can occur independent of program execu- 
tion. If an asynchronous error occurs, the operating system calls one of the follow- 
ing organization blocks: 
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OB 80 Time error 

OB 81 Power supply error 

OB 82 Diagnostics interrupt 

OB 83 Insert/remove module interrupt 
OB 84 CPU hardware fault 

OB 85 Program execution error 

OB 86 Rack failure 

OB 87 Communication error 


OB 88 Processing interrupt 


The organization block OB 82 (diagnostics interrupt) is described in Chapter 
5.8.1 “Diagnostics interrupt, organization block OB 82”. 


Calling these asynchronous error organization blocks can be disabled and enabled 
using the system functions DIS IRT and EN_IRT and delayed and enabled using 
DIS_AIRT and EN_AIRT. 


Time error OB 80 


The operating system calls the organization block OB 80 if one of the following 
errors occurs: 


> Cycle monitoring time exceeded 


> OBrequest error (the requested OB is still being processed, or an OB is requested 
too frequently within a priority class) 


> Time-of-day error interrupt (time-of-day interrupt expired through setting 
ahead of time or following transition to RUN) 


If OB 80 is not present, the CPU switches to STOP in the event of a time error. The 
CPU also switches to STOP if the OB is called for a second time in the same program 
cycle because of a cycle time violation. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the time error OB contains the tags 


OB80_FLT_ID Start request (error code) 
OB80_ERROR_EV_CLASS _ Error-triggering event class 
OB80_ERR_EV_NUM Error-triggering event number 
OB80_OB_PRIORITY Error information depending on the error code 
OB80_OB_NUM Error information depending on the error code 


You can use these tags to determine the cause of the time error. For example, if the 
OB80_FLT_ID tag is B#16#02 (OB request error), the priority class of the OB that has 
caused the error is present in the OB80_OB PRIORITY tag and the number of this 
OB in OB80_OB NUM. 
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Power supply error OB 81 


The operating system calls the organization block OB 81 if one of the following er- 
rors occurs: 


> Atleast one backup battery in the central rack or in an expansion unit 
is empty 


> No backup voltage in the central rack or an expansion unit 


> Failure of the 24 V supply in the central rack or in an expansion unit 


A battery error is only reported if the battery test with the switch BATT.INDIC is ac- 
tivated on the power supply module. OB 81 is called if there is an incoming or out- 
going event. If OB 81 is not available, the CPU continues to run in the event of a pow- 
er supply failure. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the power supply error OB contains the 
tags 


OB81_FLT_ID Start request (error code) 
OB81_RACK CPU Error-triggering central rack 
OB81_RESERVED_4 Error-triggering expansion rack 
OB81_RESERVED_5 Error-triggering expansion rack 
OB81_RESERVED_6 Error-triggering expansion rack 


With the aid of these tags, you can determine in which rack the backup battery or 
24 V power supply failed. If, for example, the tag OB81_FLT_ID is occupied with 
B#16#31 (at least one backup battery in at lease one expansion rack is empty or er- 
ror eliminated), then the number of the expansion rack is found in the tags 
OB81_RESERVED_6 (number 1 to 7), OB81_RESERVED_5 (number 8 to 15), or 
OB81_RESERVED_4 (number 16 to 21). 


Insertremove module interrupt OB 83 


The operating system monitors the module configuration every second. Every in- 
sertion or removal of a configured I/O module in the RUN, STOP and STARTUP states 
results in an entry in the diagnostic buffer and in the system state list. 


In addition, the operating system calls the operation block OB 83 in RUN. If OB 83 
is not present, the CPU switches to STOP in the event of an insertiremove module 
interrupt. 


One second can pass until triggering of the insert(remove module interrupt. It is 
therefore possible that, when removing an I/O module, an access error or an error 
in process image updating is signaled in the meantime. 


If a suitable module is inserted into a configured slot, automatic parameterization 
of the module is carried out by the CPU using the data records present on the latter. 
The OB 83 is only called after this in order to signal the inserted module as being 
ready for operation again. 
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In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the insert/remove module interrupt OB 
contains the tags 


OB83_MDL_ID Interrupt-triggering peripheral area I:P (B#16#54) or 
Q:P (B#16#55) 


OB83_MDL ADDR Module start address of interrupt-triggering module 
OB83_RACK NUM Number of rack or number of distributed station 


OB83_MDL_TYPE Type of interrupt-triggering module 
You can determine the interrupt-triggering module using these tags. 


The RALRM statement (read additional interrupt information) can provide further 
interrupt information with an insertfrremove module interrupt in a DPV1 or 
PROFINET-capable CPU (see Chapter 5.6.9 “Reading additional interrupt informa- 
tion” on page 212). 


CPU hardware fault OB 84 


The operating system calls the organization block OB 84 ifa memory error has been 
detected or eliminated. If OB 84 is not available, the CPU remains in RUN mode (if 
it does not switch to STOP with the error “CPU defective”). 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the CPU hardware fault OB contains the 
tag 


OB84_FLT_ID Start request (error code) 


You can use organization block OB 84 to write a user message in the diagnostic buf- 
fer with the system function WR_USMSG. 


Program execution error OB 85 


The operating system calls the organization block OB 85 when one of the following 
events occurs: 


> Start request for an organization block that is not loaded 


> Error during access of operating system to a block (e.g. instance data block 
missing when calling a system function block SFB) 


> I/O access error with system (automatic) updating of process image 
(configurable) 


The OB 85 is not called by default if an I/O access error occurs during automatic up- 
dating of the process image. The substitute value or zero is entered into the associ- 
ated byte upon the first faulty access; it is no longer updated thereafter. 


You can set how the OB85 call is to be handled in the event of an I/O access error on 
the system side during hardware configuration in the Cycle group of the CPU prop- 
erties: 
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> OB 85 is called each time. The associated input byte is written each time with the 
substitute value or zero. 


> OB 85 is called upon the first access error with the attribute “Incoming”. An af- 
fected input byte is only written the first time with the substitute value or zero; 
it is no longer updated thereafter. Once the error has been eliminated, the OB 85 
is called with the attribute “Outgoing”; an affected input byte is subsequently up- 
dated “normally” again. 


> OB 85 is not called in the event of an access error. Affected input bytes are only 
written once with the substitute value or zero and no longer updated thereafter. 


If OB 85 is not present, the CPU switches to STOP in the event of a program execu- 
tion error. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the program execution error OB contains 
the tags 


OB85_ ERR _EV_CLASS _ Error-triggering event class 
OB85_ERR_EV_NUM Error-triggering event number 

OB85_OB PRIOR Priority class of the OB that caused the error 
OB85_OB NUM Number of the OB that caused the error 


You can use these tags, for example, to determine a called organization block which 
is not present in the program. 

Rack failure OB 86 

The operating system calls the organization block OB 86 if 

> acentral expansion unit fails or is ready for operation again, 

> aDP master system fails or becomes available again, 

> adistributed station (PROFIBUS DP or PROFINET IO) fails or returns, and 


> adistributed station (PROFIBUS DP or PROFINET IO) is activated with the system 
function A_ACT_DP with MODE = 3 or deactivated with MODE = 4. 


If OB 86 is not present, the CPU switches to STOP upon one of the above-mentioned 
events. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the rack failure OB contains the tags 


OB86_FLT_ID Start request (error code) 
OB86_MDL_ ADDR Module address depending on the error code 
OB86_RACKS FLT Additional information depending on the error code 


You can use these tags, for example, to determine the IO system and the station 
number of a failed or returned IO device. 
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Communication error OB 87 


The operating system calls the organization block OB 87 if a communication error 
occurs. Communication errors can be, for example: 


> Sending of diagnostics entries not possible 
> Error in time-of-day synchronization 


If OB 87 is not available, the CPU remains in RUN mode in the event of a communi- 
cation error. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the communications error OB contains 
the tags 


OB87_FLT_ID Start request (error code) 
OB87_RESERVED_3 Information depending on the error code 
OB86_RESERVED 4 Information depending on the error code 


You can use these tags, for example, to determine an illegal jump in time due by 
means of time synchronization. 


Processing interrupt OB 88 


The operating system calls the organization block OB 88 after a block execution has 
been canceled in the user program. Possible causes: 


> In the event of asynchronous error, the permitted nesting depth is exceeded. 
> In the event of a block call, the permitted nesting depth is exceeded. 


> Anerror occurred when assigning the temporary local data to a block. 


If OB 88 is not present, the CPU switches to STOP upon one of the above-mentioned 
events. 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
with a CPU 400 the Start information of the rack failure OB contains the tags 


OB88_SW_FLT Start request (error code) 

OB88 BLK TYPE Type of block in which the error occurred 

OB88_ FLT PRIORITY Priority class of the OB that caused the error 
OB88_ FLT_OB NUMBR Number of the OB that caused the error 

OB88 BLK NUM Number of the block with erroneous machine code 
OB88 PRG_ADDR Relative address of the erroneous machine code 


You can use organization block OB 88 to write a user message in the diagnostic buf- 
fer with the system function WR_USMSG. 
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5.7.6 Disable, delay, and enable interrupts and asynchronous errors 


Disable, delay, and enable system functions for interrupt events influences all inter- 
rupts and all asynchronous errors. Fig. 5.32 shows the graphic representation of 
the system functions. 


Disable, delay, and enable interrupt events 


SFC 39 SFC 40 
Disable Enable disabled 
interrupt events interrupt events 
DIS_IRT EN_IRT 
— MODE RET VAL—- — MODE RET_VAL — 
—  OB_NR —  OB_NR 
SFC 41 SFC 42 
Delay Enable delayed 
interrupt events interrupt events 
DIS_AIRT EN_AIRT 
RET_VAL —— RET_VAL —— 


Fig. 5.32 System blocks for handling interrupt events 


DIS_IRT Disable interrupt events 


DIS_IRT disables the processing of new interrupt events and asynchronous error 
events. All new interrupts and asynchronous errors are rejected. If an interrupt or 
asynchronous error occurs following disabling, the associated organization block 
is no longer processed; if the OB does not exist, the CPU does not switch to STOP. 


Disabling of processing applies to all priority classes until canceled again by 
EN_IRT. The processing of all interrupts and asynchronous errors is enabled again 
following a warm restart. 


You can use the MODE and OB_NR parameters to specify which interrupts and asyn- 
chronous errors are to be disabled (Table 5.10). Depending on the assignment of 
the MODE parameter, the disabled interrupt events are also entered into the diag- 
nostic buffer (MODE = B#16#0x) or not (MODE = B#16#8x) when they occur. 


EN_IRT Enable disabled interrupt events 


EN_IRT enables processing of the interrupt events and asynchronous error events 
which had been disabled by DIS_IRT. Following enabling, the associated organiza- 
tion block is processed if an interrupt or asynchronous error occurs; if the OB does 
not exist, the CPU switches to STOP. 
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You can use the MODE and OB_NR parameters to specify which interrupts and asyn- 
chronous errors are to be enabled (Table 5.10). 


Table 5.10 Assignment of MODE parameter with DIS_IRT and EN_IRT 


MODE Meaning with DIS_IRT Meaning with EN_IRT 

B#16#00 All newly occurring interrupt events are All newly occurring interrupt events are 
disabled. enabled. 

BH16#01 The newly occurring interrupt events of an The newly occurring interrupt events of an 
interrupt class are disabled. interrupt class are enabled. 

BH16#02 The newly occurring interrupt events of an The newly occurring interrupt events of an 
interrupt are disabled. interrupt are enabled. 

BH16#80 All newly occurring interrupt events are disabled | — 
without entry into the diagnostic buffer. 

BH16#81 The newly occurring interrupt events of an - 
interrupt class are disabled without entry into 
the diagnostic buffer. 

BH16#82 The newly occurring interrupt events of an - 
interrupt are disabled without entry into the 
diagnostic buffer. 


DIS_AIRT Delay interrupt events 


Following calling of DIS_AIRT, the program in the current organization block (in 
the current priority class) is not interrupted by an interrupt event of higher priori- 
ty. The interrupts are processed with a delay, i.e. the operating system saves the in- 
terrupt events occurring during the delay and only processes them when the delay 
has been canceled. No interrupts are lost. 


The delay in processing is retained until the end of processing of the current orga- 
nization block or until the EN_AIRT function is called. 


You can call several DIS_AIRT functions in succession. The RET_VAL parameter in- 
dicates the (new) number of calls. You must then call EN_AIRT exactly as often as 
DIS_AIRT so that the processing of all interrupts is enabled again. 


EN_AIRT Enable delayed interrupt events 


EN_AIRT enables processing of the interrupts again which have been delayed with 
DIS_AIRT. You must call EN_AIRT exactly as often as you previously called DIS_AIRT 
in the current organization block or in the blocks called within this organization 
block. 


The RET_VAL parameter indicates the (still remaining) number of effective delays. 
If RET_VAL is equal to 0, processing of all interrupts has been enabled again. 
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5.8 Diagnostics 


System diagnostics is the detection, evaluation, and reporting of errors that occur 
within the programmable controller. Examples of such errors are those in the user 
program or module failures, but also an open-circuit with signal modules. 


This chapter describes how a program can respond to a diagnostic event. Further 
possibilities offered by the programming device in online mode are described in 
Chapter 15.4 “Hardware diagnostics” on page 608. 


5.8.1 Diagnostics interrupt, organization block OB 82 


You use a diagnostics interrupt in order to respond to a change in the diagnostics 
status of a module by means of an interrupt routine. The interrupt routine for an 
incoming or outgoing diagnostic event is in organization block OB 82. 


Evaluating a diagnostics interrupt 


In the event of a diagnostics interrupt, the operating system interrupts execution 
of the user program and calls the organization block OB 82. If OB 82 is not present, 
the CPU switches to STOP. You can disable or delay processing of the OB 82 (see 
Chapter 5.7.6 “Disable, delay, and enable interrupts and asynchronous errors” on 
page 224). 


In addition to the standard data (see Chapter 4.8 “Start information” on page 141), 
the start information of the diagnostic interrupt OB contains further tags in the 
area from byte 5 to byte 11 which identify the components triggering the inter- 
rupts. You can use these tags, for example, to determine the interrupt-triggering 
event and the module. 


The additional interrupt information can be read using the system block RALRM. 
Module diagnostic data can be read using the system block RDSYSST. System block 
WR_USMSG is available for entering a user diagnostic event into the diagnostic buf- 
fer. 


The diagnostics information on the modules is consistent until OB 82 is left, i.e. it 
remains frozen. The module acknowledges the diagnostics interrupt when the pro- 
gram exits the organization block OB 82. 


Configuring a diagnostic interrupt 


A diagnostics interrupt is configured using the hardware configuration. You acti- 
vate the diagnostics interrupt and the associated event for correspondingly 
designed modules. 


With PROFINET IO controllers you can set whether communication interrupts 
(diagnostic events of the PROFINET interface) are to call the diagnostics interrupt 
OB 82: In the CPU properties under PROFINET interface > Advanced options > Inter- 
face options, activate the checkbox Call OB 82 / Fault Task if communication errors 
occur. 
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Behavior in the STOP and STARTUP operating states 


Distributed I/O stations can also generate diagnostics interrupts even if the master 
or controller station is in the STOP or STARTUP operating state. The central CPU 
cannot call or process the diagnostics organization block when at STOP; processing 
of the diagnostics interrupt is not carried out later either when the CPU goes to 
RUN. Diagnostics interrupts occurring in the STARTUP operating state are pro- 
cessed in the transition from STOP to RUN. 


The received interrupt events are entered into the diagnostic buffer and into the 
module status data both at STOP and STARTUP. You can read the module status data 
with the system function RDSYSST. 


5.8.2 Read system state list 


The system state list (SSL) describes the current status of an automation system. 
The contents of the SSL can only be read using information functions, contents can- 
not be modified. Since the complete system state list is extremely comprehensive, 
reading is carried out in partial lists and partial list extracts. The partial lists are on- 
ly compiled by the CPU's operating system when requested. 


The SSL ID is available for identification of a partial list. This contains the module 
type class to which the list applies, the number of the partial list extract, and the 
actual system state partial list number (Fig. 5.33). Together with the index which 
specifies an object of a partial list, you are provided with the desired information. 
The CPU always provides information on the automation system as standard, but 
FM and CP modules can also use this service to provide information (see documen- 
tation on module). You can find the possible system state lists of a CPU in the 
description of the operation. 


Reading the header information 


With the SSL_ID W#16#0Fxx you read the header information of a system state 
partial list without the associated data set (xx = system state partial list number). 
The SSL_HEADER.N_DR parameter (number of data records) then returns the 
maximum possible number of data records of the partial list extract which the 
module can supply with an SSL job. With dynamic partial lists, the value can be 
larger than the currently readable number. The length of the data record is indi- 
cated in SSL_HEADER.LENGTHDR. With this data in the header information it is 
possible, for example, to configure a sufficiently large data buffer for the associat- 
ed system state partial list during startup. 


RDSYSST Read partial system status list 


The system function RDSYSST reads a partial list or a partial list extract of the sys- 
tem state list (SSL) (Fig. 5.33). 


You trigger reading with REQ = “1”, and BUSY = “0” indicates completion of the read 
operation. The operating system can process several asynchronously triggered 
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Read system state list 


SFC 51 
Read system state list 


RDSYSST RDSYSST: Structure of SSL_HEADER parameter 
— REQ RET VAL — SZL_HEADER : STRUCT 
= LENGTHDR : WORD Length of a data record 
— Bee SUSY N_DR : WORD Number of data sets 
— INDEX SZL_HEADER —— 
DR — 


Structure of the SSLID 


15 14 13 12 BION 7 6 5 6 406U3hUlU2 lh COO 


X A A J 
_ a i ~Y 
Module type class: Partial list extract SSL partial list number 
0000 = CPU 
0100 =IM 
1000 = FM 
1100 =CP 


Fig. 5.33 Read system state list and structure of the SSL ID 


read operations quasi-simultaneously; the number depends on the CPU. If 
RDSYSST signals a shortage of resources (W#16#8085) in the function value, trig- 
ger the read operation again. 


You can obtain the assignments of the SSL_ID and INDEX parameters from the op- 
eration list for the CPU. Example: SSL_ID =W#16#0111 and INDEX = W#16#0001 are 
used to read out the CPU type and the version number. If the INDEX parameter is 
not required for information, its assignment is irrelevant. 


In the DR parameter you specify the tag or data area in which RDSYSST is to enter 
the data records. For example, P#DB200.DBX0.0 WORD 256 provides an area of 
256 data words in data block DB 200, starting at DBB 0. If the provided area is too 
small, as many data records as possible are supplied. Only complete data records 
are transmitted. However, the area must be able to accommodate at least one data 
record. 


5.8.3 Read start information 


RD_SINFO Read start information 


RD_SINFO provides the start information of the current organization block — this is 
the OB at the top of the call tree - and also that of the last executed startup OB ina 
lower call level (Fig. 5.34). 


The TOP_SI output parameter contains the first 12 bytes of the start information of 
the current OB, the START_UP_SI output parameter contains the first 12 bytes of the 
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Read start information 


SFC 6 
Read start information 


RD_SINFO Structures of the TOP_SI and START_UP_SI parameters 
RET VAL TOP_SI : STRUCT 
TOP_Ssi — EV_CLASS  : BYTE Start information and error class 


EV_NUM _~ : BYTE Event number 


START_UG_S) PRIORITY :BYTE Priority class 
NUM : BYTE OB number 
TYP2.3 : BYTE Identifier of additional 


The parameter TOP_SI contains information 2. 3 


the start gue on of the TYP1 : BYTE Identifier of additional 

current organization block and information 

a acne es Siecle ea ZI1 :WORD Additional information 1 
a Pe ee aa ZI2 :DWORD Additional information 2.3 


organization block. 


Fig. 5.34 Read start information RD_SINFO 


start information of the last executed startup OB. The time stamp is not included in 
either case. The structure of the start information is described in Chapter 4.8 “Start 
information” on page 141. 


Calling of RD_SINFO is not only permissible at any position within the main pro- 
gram but also in each priority class, including the program of an error organization 
block or in the startup. For example, if RD_SINFO is called in an interrupt organiza- 
tion block, TOP_SI contains the start information of the interrupt OB. TOP_SI and 
START_UP_SI have identical contents when calling in the startup. 


5.8.4 Determine connection status 


C_DIAG Determine connection status 


C_DIAG determines the current status of all S7 connections. You can use the re- 
ceived connection data to identify and report the failure of a connection to a PLC or 
HMI station. (Fig. 5.35). 


With each call, C_DIAG reads the connection data from the operating system and 
enters it into the user memory for evaluation. Then C_DIAG acknowledges the read- 
out in the operating system so that a status change since the last read-out can be 
recorded. If you would like to permanently monitor the connections, call up C_DIAG 
at regular intervals, e.g. every 10 seconds in a cyclic interrupt organization block. 


C_DIAG is a system function which operates asynchronously. They trigger the job 
by signal state “1” at the REQ parameter. If the job can be immediately carried out, 
C_DIAG returns the signal state “O” on the first call at parameter BUSY, otherwise 
the job is still being processed (BUSY = “1”). 


C_DIAG can work in various modes,which you can set at the MODE parameter: 
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Scan status of all S7 connections 


SFC 87 
Determine connection status 


C DIAG Parameter CON_ARR 
Any The parameter CON_ARR is supplied with an ANY pointer 

to a data structure that is constructed as a data field and 

— REQ RET_VAL —— contains the data of a connection for each field element: 

— MODE BUSY — ARRAY [1..n] OF STRUCT 

N_CON — with n being the maximum number of possible connections, 
CON ARR — and with the structure of a connection entry shown in 
= the table. 


Structure of a connection entry 


Name Datatype | Meaning 

CON_ID WORD Event ID 

STAT_CON BYTE Connection status 

PROD_CON BYTE Partial connection number of productive connection 
STBY_CON BYTE Partial connection number of standby connection 
DIS_PCON BOOL Change of high availability (with signal state "1") 
DIS_CON BOOL Change of connection (with signal state "1") 

RESO BYTE Reserve (B#16#00) 

RES1 BYTE Reserve (B#16#00) 


Fig. 5.35 Determine connection status C_DIAG 


> MODE = B#16#00 
C_DIAG acknowledges the readout without copying the connection data. 


> MODE = B#16#01 
C_DIAG copies the connection data and acknowledges the readout. 


> MODE = B#16#02 
C_DIAG copies the connection data only when they have changed and acknowl- 
edges the readout even if no change has occurred. 


> MODE = B#16#03 
C_DIAG copies the connection data without acknowledging. 


C_DIAG transfers the current connection data from the operating system to the des- 
tination area specified at the CON_ARR parameter. The destination area is a field of 
structures; one field component contains the data for one connection. The number 
of field elements (structures) must equal the number of possible connections. At 
parameter N_CON, the field index of the last field element (the last connection) is 
specified with a status change. 


The field with the connection data is not arranged according to the connection IDs; 
the individual connections can be arbitrarily assigned to the field elements. There 
can also be field elements with invalid connections between field elements with val- 
id connections. The data of a connection are consistent with each other. 
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5.8.5 System diagnostics with Report System Errors 


System diagnostics with “Report System Errors” (RSE) offers system blocks which 
evaluate information provided by the operating system in the event of an error and 
prepare corresponding messages. In order to use the RSE diagnostics, activate the 
corresponding PLC properties, generate the required system blocks, and define the 
message texts as necessary. 


Settings for the RSE diagnostics 


During the hardware configuration, the properties of the selected CPU are dis- 
played in the inspector window on the Properties tab. In the CPU properties, select 
the System diagnostics group and activate under General the Activate system 
diagnostics for this PLC checkbox. You can additionally activate the sending of mes- 
sages and determine that the RSE diagnostics is adapted to any hardware modifica- 
tions each time compilation is carried out. 


Under Messages > Message structure select the component which triggers the mes- 
sage, e.g. the station, and compile the desired message text from the individual in- 
formation provided. You can change or delete the text present in the Message text 
and Info text fields, or add new text to it. The tag dummy used is indicated by the 
editor in pointed brackets. Under Messages > Message attributes set the message at- 
tributes for the component which triggers the message. 


Under System diagnostics blocks adapt the block names and block numbers of the 
system blocks used to your project. You define the names and numbers of the status 
data blocks under Diagnostics support. If the Web server is activated on the CPU, the 
diagnostics status DB must also be activated. Further settings apply to the status 
scanning of I/O stations during startup and the output of a message if an I/O station 
is activated or deactivated during runtime using the system function D_ACT_DP. 


The system diagnostics must be called in all supported error organization blocks, 
in the startup organization block, and either in the main program organization 
block or in a cyclic interrupt organization block. If you have not already done so 
yourself, you can generate the organization blocks as well as the call of the system 
diagnostics blocks in these organization blocks under Advanced settings > 
OB configuration. Under PLC in STOP you set the error class for which the CPU is to 
be set from the RUN operating state to the STOP operating state in the event of an 
error. 


Blocks for the RSE diagnostics 


Fig. 5.36 shows the data structure for system diagnostics with Report System Er- 
rors. The system blocks for RSE diagnostics are generated in accordance with the 
settings in the CPU properties for system diagnostics, and saved in the project tree 
under Program blocks > System blocks > System diagnostics. 


When generating the error organization blocks, the editor only generates the orga- 
nization blocks OB 80 Time error, OB 84 Hardware error, and OB 85 Program 
execution error so that the CPU does not go to STOP should a corresponding error oc- 
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Data structure for system diagnostics with Report System Errors 


Diagnostics program with 
Report System Errors 


Diagnostics with Report System 


OB 100 RSE_DB Errors (RSE) is called in the startup OB, 
in the main program OB (optionally in 
Startup => RSE_FB a cyclic interrupt OB) and in selected 
[preteen — xxx ' ? RSE error OBs. 
GLOBAL_DB The RSE diagnostics starts with calling 


of the RSE_FB, which calls the RSE_FC. 
The RSE_FB additionally requires a 
0B 1 global data block. 


Main => => RSE_FC 
program = 
— Xxx 
Optional 

OB 3x 


Cyclic > 
interrupt 
program 


OB 8x 


eee => As a further optional function, global 
data blocks with status information can 
<> | Status_DBs be generated which represent the 
interface to the signaling system of an 
HMI station or of the CPU Web server. 


program 


Fig. 5.36 Data structure for the RSE diagnostics 


cur (you set the errors for which the CPU is to go to STOP in the CPU properties un- 
der System diagnostics > Advanced settings > PLC to STOP). The RSE diagnostics is not 
called in this OB, and no errors are evaluated either. The organization blocks OB 82 
Diagnostics interrupt, OB 83 Insert/remove module interrupt, and OB 86 Rack failure 
are created by calling the RSE diagnostics. The RSE diagnostics is additionally called 
in the startup program and either in the main program or in a cyclic interrupt pro- 
gram. 


Generation of the status data blocks is optional. The diagnostics status data block 
(RSE_DIAGNOSTICS_STATUS_DB, DB 127) must be present if the Web server is acti- 
vated and contains all information on the current status of the system. The data 
blocks for PROFINET or PROFIBUS diagnostics only contain the corresponding par- 
tial information. 


When defining the diagnostics properties you can adapt the names and numbers of 
all diagnostics blocks to the naming system of your project. 
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5.9 Configure alarms 


5.9.1 Introduction 


Alarms, to put it plainly, indicate events. An event can be the signal state change of 
an input or of a bit memory, for example, or a specific status during the processing 
of the user program. An alarm is normally displayed on a display device (on an HMI 
station). An event-dependent alarm can be configured with a specific alarm text and 
alarm attributes and thus point to warnings or faults in the controlled process and 
their origin. 


SIMATIC S7 distinguishes between the following types of alarms: 


> PLC alarms 
PLC alarms report events which occur synchronously with the processing of the 
user program. They are assigned to a respective block. They are created using the 
program editor and edited in the alarm editor. 


> User diagnostic alarms 
A user diagnostic alarm writes an entry in the diagnostic buffer and sends an 
alarm to a display device. User diagnostic alarms are assigned to a CPU. These 
alarms are configured and edited using the alarm editor. 


> System alarms 
System alarms report events on modules. They are activated or deactivated in 
the hardware configuration. They can be viewed, but not edited, in the alarm ed- 
itor. 


An alarm is identified by a number that is unique within the CPU. 


Messaging methods 


The messaging method defines the way in which alarms are configured, initiated, 
and displayed. The messaging method used must be available both in the PLC sta- 
tion and in the HMI station. 


Bit messaging uses a bit in the PLC as alarm signal. If the signal state of the alarm 
signal changes, an alarm which has been configured in the HMI station is displayed 
on the HMI station. 


Analog messaging monitors a digital value which, for example, is derived from an 
analog input module to detect exceeding or undershooting a limit value and gener- 
ates the alarm signal from the limit violation. The alarms are configured in the HMI 
station. 


During the message numbering an alarm is initiated in the PLC station by calling a 
message block. The alarm number and associated alarm texts are configured in the 
PLC station, compiled, and then transferred to the HMI station. During runtime, the 
PLC station sends a alarm number and the time stamp to the HMI station. The dis- 
play of the alarms is configured in the HMI station. 


The configuration for the message numbering with block-related alarms in a PLC 
station is described in the following. 
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Parts of an alarm 


The displaying of an alarm depends on the messaging method, the message block, 
and display device. The possible components of an alarm are: 


The time stamp shows when the event occurred in the programmable controller. 


The alarm number is unique CPU-wide. It is assigned by STEP 7 and it identifies 
an alarm. 


The alarm status shown the status of an alarm: incoming, outgoing, outgoing 
without acknowledgment, outgoing with acknowledgment. 


For PLC alarms and user diagnostic alarms the alarm text is configured by the 
user. 


The alarm may have assigned associated values that contain a value from the 
controlled process. 


Message blocks 


An alarm is generated by a message block. Table 5.11 shows the available message 
blocks and their main properties. The message blocks ALARM_D or ALARM_DQ re- 
place the message blocks ALARM_S or ALARM_SQ. 


Table 5.11 Message blocks for the message numbering 


Block name Channels Associated values Acknowledgement _ | Instance data 
ALARM ‘l Up to 10 Possible Yes 
ALARM_8 8 None Possible Yes 
ALARM_8P 8 Up to 10 Possible Yes 
NOTIFY 1 Up to 10 None Yes 
NOTIFY_8P 8 Up to 10 None Yes 
ALARM_S 1 1 None no 
ALARM_SQ 1 1 Possible no 
ALARM_D 1 1 None no 
ALARM_DQ 1 1 Possible no 


The principle of programming for the message numbering 


The program for generating alarms is located in (any) function block. The basis of 
the alarm is an input parameter of the function block, the name of which is the 
alarm name and the data type of which is harmonized with the message block used. 
(Fig. 5.37). 


In the function block, any number of alarms can be generated, even from different 
message blocks. The alarm-triggering signals and the associated values should be 
located in the local data of the function block so that other alarm signals and asso- 
ciated values can be specified for each call - for example via the input parameters 
of the function block or in the static local data, which can then be provided with di- 
rect access in the instance data block. The alarms programmed in the function 
block are the “alarm types”. 


234 


5.9 Configure alarms 


Principle of alarm programming 


Programming an alarm 


The alarms are programmed in (any) function block. An alarm occupies an input parameter of this 
function block. The name of the alarm is arbitrary; the data type of the alarm depends on the 
message block used. 


The message block that generates the alarm is called in the program of the function block. 
The alarm - the input parameter of the function block - occupies the EV_ID parameter of the 
message block. 


When calling the function block, the program editor supplies the input parameters that represent 
the alarms with the alarm numbers. 


The binary signal that triggers the alarm is created at parameter SIG of the message block, 
an associated value for the alarm at parameter SD. Both tags can be also transferred via the input 
parameters of the function block. 


Calling block 
Function block 
Bai Message block 
(Alarm number) — Alarm name EV_ID 


Alarm signal — SIG 


Associated value — SD 


Alarm types and alarm instances 


The alarms programmed in the “message function block” are the alarm types. They serve as 

a template for the “actual” alarms, which are in the instance data. Each time the function block is 
called, different instance data (instance data blocks or local instances in a multi-instance) are created 
that contain the actual alarms with the alarm numbers which are valid CPU-wide. 


“Message function block” 


o) “Locking” is used to determine which 
Alarm : ae properties of the alarm type are taken 
type No.1 go | unaltered from the alarm instance 
ge 

Instance data Instance data Instance data 

1st call 2nd call nth call 
Alarm @ @ @ 
instances No. x No. y jas No. z 


WiltA = Ulta <7], 


@ Temporary alarm number 
@ Final alarm number 


The alarm numbers are always derived from the instance data of the “message function block”. 
In this way, both message blocks without their own instance data (system functions SFC) and 
message blocks with their own instance data (system function blocks SFB) can be used. 

A message block with its own instance data stores them as a local instance in the instance data 
of the “message function block”. 


Fig. 5.37 Principle of alarm programming 


235 


5 Program execution 


When the “Message function block” is called, instance data is created either in a sep- 
arate data block (single instance) or in the instance data of the calling function 
block (local instance). Instances (“alarm instances”) are also formed from the alarm 
types by this. These are the actual alarms. 


The function block with the message blocks can also be called repeatedly. Each 
alarm instance is then given its own CPU-wide unique alarm number by the pro- 
gram editor. This can be used to identify the alarm. 


The properties of an alarm type such as alarm group or display class can be “locked”. 
A locked property is forwarded to the alarm instance in unchangeable form. An “un- 
locked” property is also forwarded, but it can be changed in the alarm instance. 


Properties of alarms 


An alarm can be provided with several properties which depend on the message 
block used. Not all of the message blocks and not all of the display devices support 
the properties listed in the following. 


The alarm text should describe the reason for the alarm or its trigger event. Associ- 
ated values, which contain the process values that were current at the time the 
alarm was initiated, can be inserted into the alarm text at any position. Certain dis- 
play devices also accept an infotext for an alarm, which can contain handling in- 
structions for the machine operator, for example, and one or more additional texts. 


When acknowledgement is mandatory, the alarm is displayed until it is acknowl- 
edged. This ensures that the alarm regarding a critical or hazardous process status 
has actually been registered by the operator. The Priority can be used to set the ur- 
gency with which the alarm must be acknowledged. Alarms that are acknowledged 
with an operator action can be grouped together into a alarm group. For example, 
this can be alarms which are all caused by the same fault or which all come from 
one machine unit or from one subprocess. 


In an alarm class, alarms with the same level of importance can be grouped togeth- 
er, such as “warnings” or “errors”. An alarm class defines the representation on the 
display device and the mandatory acknowledgement. 


A display class controls the assignment to the display unit. If, for example, several 
HMI stations are assigned to a PLC station, the display class can be activated in an 
HMI station, along with its alarms which are to be displayed at the station. 


5.9.2 Configuring alarms according to the message numbering 


Programming message blocks 


Add (any) function block as a “message function block” and define an input param- 
eter in the INPUT declaration section, which is the basis for an alarm (this is not the 
alarm-triggering signal). The name of the input parameter is the alarm name. For 
the data type, select an alarm data type which depends on the message block used 
from the drop-down list. The name of an alarm data type is the name of the message 
block with a preceding “C_”, e.g. C_ALARM for the ALARM message block. Excep- 
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tion: Message blocks without instance data all have the same alarm data type 
C ALARM S. 


Now move the message block from the program elements catalog under Expanded 
instructions > Alarms into the program of the function block. The instance data of 
the message block, if it has any, is found in the instance data of the calling “message 
function block”. 


The input parameter with the alarm data type must be created at parameter EV_ID 
of the message block. Now supply the other parameters of the message block as de- 
scribed in Chapters 5.9.3 “Message blocks for PLC alarms with instance data” on 
page 241 and 5.9.4 “Message blocks for PLC alarms without instance data” on page 
244. 


For each alarm, repeat the declaration of the “alarm input parameter” and the pro- 
gramming of the message block. In the “message function block”, several alarms 
can also be programmed with various types of message blocks. Supplement the 
program with your system-specific statements. You can also create more than one 
“alarm function block”. 


Define alarm properties in the alarm type 


In the “Message function block”, select the “Alarm input parameter” and set the 
alarm properties in the inspection window in the Properties > Alarm tab: Under Texts 
enter the infotext, the alarm text and, if needed, the additional texts and enter the 
display class, priority, alarm class, and group ID for the alarm group under Attri- 
butes (Fig. 5.38). You can activate or deactivate logging of the alarm and the 
acknowledgment requirement. Not every alarm type has all of the properties listed 
here. 


& Properties “info. pte Diagnostics 


| General Alarm 
Genera 
Attributes 
Texts 
Acinbutet 
: Oispleyciass = 2 >| i [} Report KY 
Priority 2 ~) [ge {A with acknowledgment vw 
Algerh class = Dit trbution_slarne ~| lg 
Group 4 o) gt 


Fig. 5.38 Example of alarm properties in the inspector window 


Clicking on the chain symbol for an alarm property allows you to lock (closed chain 
link) or unlock the property (open chain link). All of the alarm properties of the 
alarm type are passed on to the alarm instance. The locked properties can no longer 
be changed in the alarm instance. Unlocked ones can be changed. 


In the “Message function block” (at the alarm type), set the preferred alarm prop- 
erties which are relevant to all of the alarm instances. 
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Define alarm properties in the alarm instance 


If you call up the “Message function block” in the program of another block, specify 
the storage location of the instance data belonging to the call, either in its own in- 
stance data block or in the instance data block of the calling function block. You can 
also call up the “Message function block” several times with different instance data 
in each case. The program editor generates an alarm instance for each call from the 
alarm type in the function block with its own CPU-wide unique alarm number. This 
is the “actual” alarm. 


To set or change the properties of this alarm, open the instance data block - for a 
multi-instance, then open the local instance of the “Message function block” - and 
select the alarm in the INPUT declaration section (the input parameter with the 
alarm name). In the Properties > Alarm tab in the inspector window, you can then 
change the alarm properties which were unlocked in the alarm data type. 


After an alarm property is changed, a symbol (“type symbol”) shows that the alarm 
property has changed compared to the alarm type. If you click on the type symbol, 
the original value is adopted again from the alarm type. 


Setting alarm properties in the alarm editor 


After you have programmed the alarm types (in the “Message function block”) and 
the alarm instances (when the “Message function block” is called), you can also set 
the alarm properties using the alarm editor. 


To start the alarm editor, double-click on PLC alarms in the project tree under the 
PLC station. In the PLC alarms tab in the upper section of the work window in the 
PLC alarms table, the alarm editor shows the programmed alarm types and it shows 
the alarm instances of the selected alarm type in the bottom section in the Alarm 
instances table. The alarm properties are displayed in both tables (Fig. 5.39). Indi- 
vidual columns can be hidden and shown: Right-click in a column title and then se- 
lect the Show/hide columns > ... command from the shortcut menu. 


You can change the alarm properties directly in the tables of the alarm editor or in 
the properties tab of the inspector window (as described in sections “Define alarm 
properties in the alarm type” on page 237 and “Define alarm properties in the 
alarm instance” on page 238). 


a ACalammn |} User Gagnostic alarms [qd Syston alan 


wo 


maha? 


Fig. 5.39 Example of PLC alarms in the alarm editor 
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For a multi-channel message block, you can assign individual texts and in part in- 
dividual attributes to each individual channel (to each “subalarm”) after opening in 
the PLC alarms table or in the Alarm instances table. 


Inserting associated values 


In an alarm text, you can insert one or more associated values at any point. You 
define an associated value at the SD or SD_n parameter of the message block. You 
then insert the following expression into the alarm text for each associated value: 
@<Associated value number><Element type><Format>@. Table 5.12 shows the per- 
missible element types and formats. 


Table 5.12 Element types and formats for associated values 


Element Data type of Format | Representation of the associated value as 
type the associ- 
ated value 
Y BYTE %NX Hexadecimal number with n places 
Ww WORD %onu Decimal number without sign with n places 
X DWORD %nd Decimal number with sign and rn places 
| INT %nb Binary number with n places 
D DINT %n.mf | Fixed-point number with sign and n total places, including m 
B BOOL places after the decimal point; “m” can also be omitted 
C CHAR Character string with n places 
é BEAL %ns (display up to the character value B#16#00) 


Example: The expression @2R%6.2f@ means that the associated value at parameter 
SD_2 (“2”), which is in the REAL data type (“R”), with a total of 6 places including 2 
decimal places (“%6.2”), is to be displayed as a fixed-point number (“f”). 


If too few places are specified in the format specification, the associated value is 
nevertheless displayed in its full length. If the number of places is too great, leading 
spaces are inserted. 


You can also insert text from a text list into an alarm as an associated value. The ex- 
pression for this is: @index%t#name@; index is the reference to the text in the text 
list name. 


Example: In the Temperatures text list, the text is selected based on decimal value 
ranges (Fig. 5.40). The configured alarm text 


The temperature in the tank is @1W%t#Temperatures@. 
is output as alarm text 
The temperature in the tank is increased. 


if the first associated value with the data type WORD has the value 63. 
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Text lists 
Name Selection Comment 
« SYSTEM_SDiag_CmpComment Decimal 
Ef Temperatures Decimal y| 
« SYSTEM_InterlockAlarmTexts_3 Decimal 
3 SYSTEM _SupervisionAlarmTexts_3 Decimal 
« SYSTEM StepNames_3 Decimal 
G) SYSTEM_StepNames_4 Decimal 
&) SYSTEM_InterlockAlarmTexts_4 Decimal 
G) SYSTEM SupervisionAlarmTexts_4 Decimal 
<Add new> 


a 


Text list entries of Temperatures 


Range from Range to Entry 
Eo 25 Too low 
F§ 26 60 All right 
ER 61 70 Increased 
71 100 Too high 

<Add new> 


Fig. 5.40 Example of a text list 


Configuring text lists for alarm texts 


Texts which are assigned to an individual value or a value range are managed in a 
text list. A text from a text list can thus be searched for (referenced) based on a val- 
ue. Each text list has a unique name. A text list can be assigned to a station or toa 
project. 


To create a new text list, double-click on Text lists in the project tree under the PLC 
station (station-assigned) or on Common data > Text lists under the project (cross- 
station). In the Text lists table in the upper section of the work window, add a new 
text list and give it a unique name (Fig. 5.40). In the Selection column, define the 
value range with which the texts of the text list will be referenced: 


> “Decimal” if a decimal number or a range of decimal numbers 
(values 0 to 2!*') is the reference 


> “Binary” if a bit or a bit range in a doubleword (bits 0 to 31) is the reference 


> “Bit” ifa bit (“O” or “1”) is the reference 


Select the text list. In the Text list entries from <list name> table in the bottom section 
of the work window, define reference ranges. In the Entry column, define the asso- 
ciated texts. 


Configuring alarm classes 


To configure an alarm class, double-click on Common data > Alarm classes in the 
project tree under the project. In the Alarm classes table, enter the name of the 
alarm class and the display name and activate or deactivate the mandatory 
acknowledgement for the alarm class. Now you can assign an alarm to the new 
alarm class when configuring the alarm properties. 
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Recording and saving signals 


An alarm event is “incoming” if the alarm-triggering signal at parameter SIG or 
SIG_n changes from status “0” to status “1” (rising signal edge). An alarm event is 
“outgoing” if a signal edge falls. 


The message blocks have amemory area with two spaces for each alarm event. If the 
message block detects an incoming alarm event, the trigger for the alarm is entered 
in the first memory space. The first memory space is freed up again once the alarm 
has been generated. 


If another incoming alarm event is detected before the previous alarm has been 
generated, the second memory space is occupied. Once the alarm trigger has been 
completely processed in the first memory space, the alarm trigger that is currently 
in the second memory space is transferred to the first memory space and pro- 
cessed. 


If there is more than one incoming alarm event during the generation of an alarm, 
the second memory space is “overwritten” with the respective current alarm trig- 
ger. This loss of an alarm is displayed on the STATUS parameter and is sent with the 
next alarm to the display device. 


Alarm with mandatory acknowledgement 


For an alarm without mandatory acknowledgement, the alarm is displayed when 
the alarm event arrives. The display is ended when the alarm event leaves again. 


For an alarm with mandatory acknowledgement, the alarm is displayed when the 
alarm event arrives. The display remains until the alarm is acknowledged on the 
display device. The display is ended when the alarm is acknowledged and the alarm 
event has left. 


The alarms grouped into an alarm group are collectively acknowledged. If the man- 
datory acknowledgement is activated, the message block will not generate a new 
alarm for this signal until the “incoming” alarm has been acknowledged. The next 
alarm that the message block generates is an “outgoing” alarm, which is not ac- 
knowledged. The next “incoming” alarm must then be acknowledged again. 


If an “incoming” alarm is acknowledged, all of the preceding (and not yet acknowl- 
edged) signal state changes for this alarm are also acknowledged. 


The acknowledgment status is displayed at the output parameters of the message 
blocks with instance data, or it can be scanned with ALARM_SC for message blocks 
without instance data. 


5.9.3 Message blocks for PLC alarms with instance data 


The message blocks with instance data are system function blocks in the operating 
system of the CPU. The message blocks must be called in a function block as a local 
instance. The instance data of the message blocks can then be found in the instance 
data of the function block. 
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Message blocks without mandatory acknowledgment 


The following message blocks are available: 


> NOTIFY Alarm with up to ten associated values for a signal (SFB 36) 
> NOTIFY _8P Alarm with up to ten associated values for eight signals (SFB 31) 


Fig. 5.41 shows the graphic representation of the block calls. 


Message blocks with instance data without mandatory acknowledgment 


SFB 36 SFB 31 
Generate an alarm without Generate an alarm without 
mandatory acknowledgment mandatory acknowledgment 
from a signal from up to eight signals 
Instance data Instance data 
NOTIFY NOTIFY_8P 
— SIG DONE — —  sIG_1 DONE — 
— ID ERROR —— — SIG 2 ERROR — 
— Eva STATUS —— — STATUS —— 
— SEVERITY — SIG 8 
—sD1 — ID 
— pw — EVID 
—... — SEVERITY 
—sD_10 —sD1 
— SD_2 
— SD_10 


Fig. 5.41 Message blocks with instance data without mandatory acknowledgment 


NOTIFY generates an alarm if the signal state at the parameter SIG changes. 
NOTIFY_8P generates an alarm if the signal state at one of the eight input parame- 
ters SIG_n changes. All eight signals have acommon alarm ID that is split into eight 
individual alarms on the display device. Both message blocks always send an alarm 
during the first call. 


The alarm-triggering signal is created at the SIG or SIG_n parameter. How the sig- 
nal is processed by the message block is described in section “Recording and saving 
signals” on page 241. 


The parameter ID contains the data channel for the alarms and is occupied with the 
constant W#16#EEEE. The parameter EV_ID is provided with the input parameter of 
the “Message function block”, which contains the alarm number (see section “The 
principle of programming for the message numbering” on page 234). The parame- 
ter SEVERITY specifies the severity of the alarm in the range of 0 to 127 (the value 0 
indicates the greatest severity). This parameter is meaningless for alarm process- 
ing. 
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At an SD_n parameter, an associated value is created for the alarm if needed. Up to 
10 associated values can be parameterized. Working with associated values is de- 
scribed in section “Inserting associated values” on page 239. 


The DONE parameter indicates with signal state “1” that the alarm generation has 
been completed. If the ERROR parameter has signal state “1”, an error has occurred, 
which is specified in more detail in the STATUS parameter. 


Message blocks with possible mandatory acknowledgement 
The following message blocks are available: 

> ALARM Alarm with up to ten associated values for a signal (SFB 33) 

> ALARM _8P_ Alarm with up to ten associated values for eight signals (SFB 35) 


> ALARM 8 Alarm without associated values for eight signals (SFB 34) 


Fig. 5.42 shows the graphic representation of the block calls. 


Message blocks with instance data and possible mandatory acknowledgment 


SFB 33 SFB 34 SFB 35 
Generate an alarm Generate an alarm Generate an alarm 
with associated values without associated values with associated values 
from a signal from up to eight signals from up to eight signals 
Instance data Instance data Instance data 
ALARM ALARM_8 ALARM_8P 
— ENR DONE—— -—ENR DONE——- -—ENR DONE — 
— SIG ERROR—- -— SIG 1 ERROR —- -—— SIG 1 ERROR —— 
—lb) STATUS —- -— SIG 2 STATUS — -— SIG 2 STATUS —— 
— EVID ACK DN—- —... ACK_STATE—- —... ACK_STATE — 
— SEVERITY ACK_UP—— —SIG 8 —sIG 8 
—sD1 — ID — ID 
— sD 2 — EVID — EVID 
es — SEVERITY — SEVERITY 
— SD_10 —sD1 
— SD_2 
— SD_10 


Fig. 5.42 Message blocks with instance data and possible mandatory acknowledgment 


If the mandatory acknowledgement is deactivated, ALARM generates an alarm if 
the signal state at parameter SIG changes. ALARM_8 and ALARM_8P generate an 
alarm if the signal state at one of the eight input parameters SIG_n changes. All 
eight signals have a common alarm ID that is split into eight individual alarms on 
the display device. All message blocks always send an alarm during the first call. 
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Alarm processing with activated mandatory acknowledgement is described in sec- 
tion “Alarm with mandatory acknowledgement” on page 241. 


The alarm-triggering signal is created at the SIG or SIG_n parameter. How the sig- 
nal is processed by the message block is described in section “Recording and saving 
signals” on page 241. 


The parameter ID contains the data channel for the alarms and is occupied with the 
constant W#16#EEEE. The parameter EV_ID is provided with the input parameter of 
the “Message function block”, which contains the alarm number (see section “The 
principle of programming for the message numbering” on page 234). The parame- 
ter SEVERITY specifies the severity of the alarm in the range of 0 to 127 (the value 0 
indicates the greatest severity). This parameter is meaningless for alarm process- 
ing. 


At an SD_n parameter, an associated value is created for the alarm if needed. Up to 
10 associated values can be parameterized. Working with associated values is de- 
scribed in section “Inserting associated values” on page 239. 


The parameter EN _R controls the updating of the acknowledgement display at the 
output parameters ACK_DN and ACK UP or ACK_STATE. If EN_R is occupied with 
signal state “1”, the acknowledgement display is updated during the block call. 
With signal state “0”, the acknowledgement displays remain unchanged. If an ac- 
knowledgement has been made for an incoming alarm event, the parameter 
ACK_UP or the bits 0 through 7 of the ACK_STATE parameter have signal state “1”. 
If an acknowledgement has been made for an outgoing alarm event, the parameter 
ACK_DN or the bits 8 through 15 of the ACK_STATE parameter have signal state “1”. 


The DONE parameter indicates with signal state “1” that the alarm generation has 
been completed. If the ERROR parameter has signal state “1”, an error has occurred, 
which is specified in more detail in the STATUS parameter. 


5.9.4 Message blocks for PLC alarms without instance data 


The message blocks without instance data are system functions in the operating 
system of the CPU. The following message blocks are available: 


> ALARM SQ _ Alarm with possible acknowledgement for a signal (SFC 17) 
> ALARM_S Alarm without acknowledgement for a signal (SFC 18) 

> ALARM DQ Alarm with possible acknowledgement for a signal (SFC 107) 
> ALARM_D Alarm without acknowledgement for a signal (SFC 108) 

Fig. 5.43 shows the graphic representation of the block calls. 


The message blocks without instance data generate an alarm during each call if the 
signal state of the alarm-triggering signal at parameter SIG has changed. If the sig- 
nal state has not changed compared to the preceding call, the error is reported via 
the parameter RET_VAL and no alarm is generated. During the first call of the mes- 
sage block, the parameter SIG must have signal state “1”. 
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Message blocks without instance data 


SFC 17 
Alarm with possible 
acknowledgement for a signal 


Alarm with possible 
acknowledgement for a signal 


SFC 18 
Alarm without 
acknowledgement for a signal 


ALARM_SQ ALARM_S 
— SIG RET_VAL — — SIG RET_VAL — 
— ID — ID 
— EVID — EVID 
— sD —sD 
SFC 107 SFC 108 


Alarm without 
acknowledgement for a signal 


ALARM_DQ ALARM_D 
— SIG RET_VAL —— — SIG RET_VAL — 
—iip — ID 
— EV_ID — EV_ID 
— CMP_ID — CMP_ID 
—_ 5p — ee 


Fig. 5.43 Message blocks without instance data 


The message blocks ALARM_D and ALARM _DQ replace the message blocks 
ALARM_S and ALARM_SQ. With ALARM_D and ALARM_DQ the system resources oc- 
cupied by the message blocks can be better managed (see Chapter 5.9.5 “Blocks for 
working with alarms”). 


ALARM_S and ALARM _D generate alarms that do not have to be acknowledged. The 
alarms generated for ALARM_SQ and ALARM _DQ must be acknowledged (see sec- 
tion “Alarm with mandatory acknowledgement” on page 241). 


The alarm-triggering signal is created at the SIG parameter. How the signal is pro- 
cessed by the message block is described in section “Recording and saving signals” 
on page 241. 


The parameter ID contains the data channel for the alarms and is occupied with the 
constant W#16#EEEE. The parameter EV_ID is provided with the input parameter of 
the “Message function block”, which contains the alarm number (see section “The 
principle of programming for the message numbering” on page 234). 


At an SD parameter, an associated value is created for the alarm. Working with as- 
sociated values is described in section “Inserting associated values” on page 239. 


The parameter CMP_ID - the group ID - assigns the alarm to a (freely definable) 
group. The RET_VAL parameter contains the error information. 
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5.9.5 Blocks for working with alarms 

The following system blocks are available for working with alarms: 
READ_SI Read system resources (SFC 105) 

DEL_SI Delete system resources (SFC 106) 

ALARM_SC_ Determine acknowledgment status (SFC 19) 
DIS_MSG_ Disable PLC alarms (SFC 10) 

EN_MSG_ Enable PLC alarms (SFC 9) 

AR_SEND Send archive data (SFB 37) 


Fig. 5.44 shows the graphic representation of the block calls. 


Blocks for working with alarms 


SFC 105 SFC 106 SFC 19 
Read system Delete system Determine 
resources resources acknowledgment status 
READ_SI DEL_SI ALARM_SC 
— MODE RET_VAL——- — MODE RET VAL—- -— EV_ID RET_VAL —— 
— SID NsSI|— —SILID STATE — 
SYS_INST — Q STATE — 
SFB 37 
SFC 10 SFC 9 Send archive data 
Disable PLC alarms Enable PLC alarms Instance data 
DIS_MSG EN_MSG AR_SEND 
— REQ RET VAL——- — REQ RET VAL——- — REQ DONE —— 
— MODE BUSY — — MODE BUSY — —R ERROR —— 
— MESGN — MESGN — ID STATUS —— 
— ARID 
—sD_1 
— LEN 


Fig. 5.44 Blocks for working with alarms 


Handling of system resources 


If the message blocks are deleted or reloaded (“overloaded”) during operation, it is 
possible that the occupied system resources will remain occupied. These occupied 
system resources are only released by a cold restart or a warm restart. If you use the 
message blocks ALARM_D and ALARM_DQ, you can manage the system resources 
with READ SI and DEL SI. 


READ SI reads the system resources of the ALARM_D and ALARM_DQ alarms. You 
set the operating mode of READ_SI at the MODE parameter (Table 5.13). Depending 
on the operating mode, you assign zero, the alarm number, or the group ID CMP_ID 
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Table 5.13 Operating modes of READ_SI and DEL_SI 


Block MODE | Description of the operating mode 
READ_SI 1 All occupied system resources are read. The parameter SI_ID is occupied with zero. 
2 The system resource whose alarm number is specified at parameter SI_ID is read. 
3 All of the system resources whose assignment of the parameter CMP_ID (group ID) agrees 


with the assignment at parameter SI_ID are read. 


0 Additional system resources which could not be read during preceding calls because 
the destination area was too small are read. 


DEL_SI 1 All system resources are deleted. The parameter SI_ID is occupied with zero. 
Z The system resource whose alarm number is specified at parameter SI_ID is deleted. 
3 All of the system resources whose assignment of the parameter CMP_ID (group ID) agrees 


with the assignment at parameter SI_ID are deleted. 


to the parameter SI_ID. The RET _VAL parameter contains the error detection. The 
number of output system resources is displayed at parameter N_SI. The destination 
area for the output system resources is located in a data block and is defined at 
parameter SYS_INST with an ANY pointer. A system resource has the data structure 
specified in Table 5.14. 


Table 5.14 Data structure of a system resource of ALARM_D or ALARM_DQ 


Name of the component Data type Description 

SFC_NO WORD SFC number of the message block 

LEN BYTE Length of the structure in bytes: B#16#0C 

SIG_STAT BOOL Signal state of the alarm-triggering signal 

ACK_STAT BOOL Acknowledgement status of the incoming alarm event 
EV_ID DWORD Alarm number 

CMP_ID DWORD Group identification 


DEL_SI deletes the system resources of the ALARM_D and ALARM_DQ alarms. You 
set the operating mode at the MODE parameter (Table 5.13). Depending on the op- 
erating mode, you assign zero, the alarm number, or the group ID CMP_ID to the 
parameter SI_ID. The RET_VAL parameter contains the error detection. 


Determine acknowledgment status 


ALARM SC determines the signal state of the alarm-triggering signal at parameter 
SIG of the message block and, if it is a message block ALARM_SQ or ALARM_DQ, the 
acknowledgement status of the “incoming” alarm. 


Assign the alarm number to the parameter EV_ID. 


247 


5 Program execution 


The RET_VAL parameter contains the error information. The status of the alarm- 
triggering signal at the last call of the message block is output at the parameter 
STATE. At the parameter Q_ STATE, the acknowledgement status of the last “incom- 
ing” alarm is output (“O” = not acknowledged, “1” = acknowledged) or, if it is a mes- 
sage block ALARM_S or ALARM D, the signal state “1”. 


Disabling and enabling alarms 


DIS_MSG disables block-related alarms which are generated with the message blocks 
with instance data. Alarms that are already being processed are still sent. Active dis- 
abling is indicated at the STATUS parameter of the message blocks NOTIFY, NOTI- 
FY_8P, ALARM, ALARM_8, and ALARM _8P. You set the operating mode at the MODE 
parameter: The values 0 and 1 block all alarms. The value 6 blocks an individual 
alarm whose alarm number is displayed at parameter MESGN. Disabling is started if 
the signal state at parameter REQ is “1”. If parameter BUSY has signal state “O” again, 
the execution of the disabling is completed. The RET_VAL parameter contains the er- 
ror information. 


EN_MSG clears the disabling of the alarms that was activated with DIS_MSG. You set 
the operating mode at the MODE parameter: The values 0 and 1 enable all alarms. 
The value 6 enables an individual alarm whose alarm number is specified at param- 
eter MESGN. 


Enabling is started if the signal state at parameter REQ is “1”. If parameter BUSY has 
signal state “0” again, the execution of the enabling is completed. The RET_VAL pa- 
rameter contains the error information. 


Send archive data 


AR_SEND sends archive data to an HMI station that is registered for this. The ar- 
chive number and the structure of the archive data are defined by the HMI station 
used. Figure 5.44 on page 246 shows the graphic representation of the block call. 


You program AR_SEND as local instance in a function block. You can define an input 
parameter of this function block as an archive number with the data type 
C_AR_SEND, which you select from the drop-down menu. You provide the parame- 
ter AR_ID from AR_SEND with this input parameter. 


The parameter ID contains the data channel for the alarms; it is occupied with the 
constant W#16#EEEE. An ANY pointer to the archive data to be sent is created at the 
SD_1 parameter. The length of the data to be sent is not determined by this ANY 
pointer but by the specification at parameter LEN. 


The send procedure starts with a rising edge at parameter REQ. If the parameter 
DONE has signal state “1”, the send procedure is completed. The ERROR and STATUS 
parameters provide information on an error that occurred. The send procedure is 
canceled with a rising edge at parameter R. 
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5.9.6 Configuring a user diagnostic alarm 


Auser diagnostic alarm is an alarm configured by the user and is also entered in the 
diagnostic buffer. WR_USMSG is the “message block” which generates the alarm 
and enters it in the diagnostic buffer. At the same time, it can send the alarm toa 
display device. This user diagnostic alarm is configured using the alarm editor. 


Write user diagnostic event to the diagnostic buffer 


WR_USMSG writes an entry to the diagnostic buffer and can send it to all logged-on 
display units (Fig. 5.45). 


The structure of the entry in the diagnostic buffer corresponds to the start informa- 
tion of an organization block. You can freely select the event ID (EVENTN parame- 
ter) and the additional information (INFO1 and INFO2 parameters) in the context 
of the permissible assignment. 


The event ID is identical to the first two bytes of the buffer entry (Fig. 5.45). Event 
classes 8 (predefined diagnostics entries for signal modules), 9 (predefined stan- 
dard user events), A and B (freely available user events) are permissible for a user 
entry. 


Write user diagnostics event to the diagnostics buffer 


SFC 52 . . Structure of a diagnostics buffer entry 
Write user diagnostics event 
to the diagnostics buffer Byte Contents Parameter 
0 and 1 Event ID EVENTN 
WR_USMSG eos 
2 Priority class 
— SEND RET_VAL ——- 3 OB number 
— EVENTN 4and5 Reserved 
— INFO1 6and7 Additional information 1 INFO1 
— INFO2 8toll Additional information 2 INFO2 
12 to 19 Time stamp 


Structure of the event ID 
"1" = external error 
"{" = internal error 


"1" = diagnostics buffer entry 
"{" = incoming event 
= 
15 14 13 12 BONS oe 7 6 5 4 C06U38hlU2lhlhd1C CO 


UY Me, \- J 
Event class: Event number 


Identifiers 


1000 = diagnostics entry for signal module 
1001 = standard user event 

1010 = for free use 

1011 = for free use 


Fig. 5.45 Write user diagnostic event to the diagnostic buffer 
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The additional information 1 corresponds to the bytes 6 and 7 of the buffer entry 
(one word), and additional information 2 to the bytes 8 to 11 (one doubleword). The 
contents of both tags are freely selectable. 


Using SEND = “1” you define that the diagnostic buffer entry is to be sent to the 
logged-on nodes. Even if sending is not possible (e.g. no display unit is logged-on 
or the send buffer is full), the entry is nevertheless made in the diagnostic buffer (if 
bit 9 of the event ID is set). 


Configuring a user diagnostic alarm 


You configuring a user diagnostic alarm in the alarm editor. A double-click on PLC 
alarms in the project tree under the PLC station starts the editor. In the User diag- 
nostic alarms tab, create a new alarm by entering the alarm name. In the Error class 
column, you can choose between “A” and “B”. These are the freely available user 
events. Enter a number between 1 and 255 in the Number column. The ID column 
then shows the alarm number which you specified at the parameter EVENTN of 
block WR_USMSG. 


You can enter the infotext and the texts for the incoming and outgoing alarm events 
in the table or, if an alarm is selected, in the inspector window in the Properties tab. 


5.9.7 CPU alarm display 


The Alarm display function outputs the alarms saved in the CPU in online mode on 
a programming device. The alarm archive encompasses alarms from asynchro- 
nously occurring diagnostic events, user diagnostic alarms, and alarms from mes- 
sage blocks without instance data. The alarm is displayed in the STEP 7 inspector 
window. 


Setting the alarm archive 


To set the alarm archive, select the command Options > Settings in the main menu. 
In the Online & Diagnostics group, you can 

> activate or deactivate the multi-line display in the inspector window 

> activate or deactivate the automatic display of the current alarms 

> select the size of the alarm archive from a drop-down menu step-by-step 


in the range from 200 to 3000 alarms. 


If the alarm archive is full, the oldest alarm will be overwritten by the newly incom- 
ing alarm. 


Receiving alarms 


To display the alarms, activate the function Receive alarms. To do this, switch the 

programming device to online mode and, 

> with the PLC station selected, select the command Online > Receive alarms from 
the main menu or Receive alarms from the shortcut menu, or 


> double-click in the project tree under the PLC station on Online & diagnostics and 
activate the checkbox Receive alarms in the work window under Online access and 
alarms. 
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Displaying alarms 


The alarms are listed in the inspector window in the Diagnostics and Alarm display 
tabs (Fig. 5.46). 


& Properties % Diagnostics 


Newent temneed 
Alarm display Device information | Connection information 
= , v -» i + 


Mews CU 


Time Type 1» fyent teat 
39-305 Pu info Alarms (diegnostc events) ectiveted Alarms (process | « 
352PM INFO Alorm updete start 


7PM INFO alarm update end 
63643923 PM OF MODE Cucreet opereting mode: STOP 


63645420'mM 8 OF_MOOE Current operating mode: Warm restert 
63645451PM OF MODE Current opersting mode: RUN 


Fig. 5.46 Example of the alarm display of the CPU alarms 


The table shows the alarms in the chronological order of their occurrence. To select 
the columns to be displayed, right-click in a column title and then select the 
Show/hide columns command from the shortcut menu. The order and width of the 
columns can be changed using the mouse. 


You control the display with the symbols in the Alarm display tab. From left to right, 
the symbols are: 


Archive view: displays the alarms in the alarm archive in chronological order of 
occurrence. 


Active alarms: displays the currently pending alarms; alarms requiring acknowl- 
edgement are displayed in bold. 


Ignore: the displaying and archiving of the subsequent alarms are deactivated or 
activated; the activation or deactivation is displayed as a alarm. 


Acknowledge: acknowledges the selected alarm(s). 
Empty archive: deletes all of the alarms in the alarm archive. 


Export archive: exports the alarm archive to a file in .xml format. 


Alarm number display: selects the type of alarm number display (decimal or 
hexadecimal). 


Acknowledge alarms 


You can acknowledge the alarms requiring acknowledgement that were generated 
by the message blocks ALARM_SQ and ALARM _DQ by selecting the relevant 
alarm(s) and clicking on the Acknowledge symbol or by pressing [Ctrl] + Q. The 
alarms generated by ALARM_S or ALARM _D are automatically acknowledged. 
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Status of the alarms 


An alarm can have the following status in the archive view: incoming (display 
with I), incoming and acknowledged (A), outgoing (O), and deleted (D). alarms 
that are generated by the programming device such as a mode transition are dis- 
played without a status. 


In the “Active alarms” view, the alarm status is displayed as follows: I (the alarm is 
incoming), IA (incoming and acknowledged), and IO (outgoing). 


An “O” (Overflow) in red is displayed in the status column if more alarm events come 
in than the number of alarms that can be sent and displayed. 
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6 Program editor 


6.1 Introduction 


This chapter describes how you work with the program editor with which the user 
program is written in the programming languages LAD, FBD, STL, SCL, and GRAPH. 
The special features of programming in the respective programming language are 
described in the Chapters 7 “Ladder logic LAD” on page 283, 8 “Function block dia- 
gram FBD” on page 315, 9 “Statement list STL” on page 348, 10 “Structured Control 
Language SCL” on page 397, and 11 “S7-GRAPH sequential control” on page 431. 


The user program consists of blocks which are saved in the project tree under a PLC 
station in the Program blocks folder. Code blocks contain the program code, and da- 
ta blocks contain the control data. When programming, a block is initially created 
and subsequently filled with data or a program. Ladder logic (LAD), function block 
diagram (FBD), statement list (STL), structured control language (SCL), and se- 
quential control (GRAPH) are available as languages for programming the control 
function. You can define the programming language individually for each block. 


The system blocks used in the user program and the instance data blocks of system 
function blocks are saved in the System blocks folder under Program resources. 


The External sources folder contains externally edited source files for STL and SCL 
blocks. Chapter 18.1 “Working with source files” on page 707 describes how to han- 
dle external source files. 


The user program works with operands and tags. Block-local tags are declared 
during programming of the blocks, global operands and tags are present in the PLC 
tags folder. The PLC data types folder contains user-defined data structures for tags 
and data blocks. 


Programming is appropriately commenced by definition of PLC tags and PLC data 
types. This is followed by the global data blocks with the already known data. In the 
case of the code blocks, one starts with those which are at the lowest position in the 
call hierarchy. The blocks in the next higher level in the hierarchy then call the 
blocks positioned below them. The organization blocks in the highest hierarchy 
level are created last. 


Following completion, the user program is compiled, i.e. the program editor con- 
verts the data entered into a program which can be executed on the CPU. 
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6.2 PLC tag table 


The user program works with operands, e.g. inputs or outputs. These operands can 
be addressed in absolute mode (e.g. %11.0) or symbolic mode (e.g. “Start signal”). 
Symbolic addressing uses names (identifiers) instead of the absolute address. As 
well as the name, you define the data type of the operand. The combination of op- 
erand (absolute address, memory location), name, and data type is referred to asa 
“tag”. 

When writing the user program, a distinction is made between Jocal and global tags. 
A local tag is only known in the block in which it has been defined. You can use local 
tags with the same name in different blocks for different purposes. A global tag is 
known throughout the entire user program, and has the same meaning in all 
blocks. You define global tags in the PLC tag table. 


Refer to Chapter 6.6.1 “Cross-reference list” on page 276 for how to create a cross- 
reference list of the PLC tags. Monitoring of tags using the PLC tag table is described 
in Chapter 15.5.5 “Monitoring of PLC tags” on page 621. 


6.2.1 Editing PLC tag tables 


When creating a PLC station, a PLC tags folder with the PLC tag table is also created. 
You can open the PLC tag table by double-clicking on Standard tag table in the PLC 
tags folder. The standard tag table consists of the Tags, User constants, and System 
constants tabs. 


You can create additional tag tables containing PLC tags and user constants with 
the Add new tag table function (Fig. 6.1). These self-created tables can be renamed 
and organized in groups. A tag or a constant can only be defined in a table. To 
obtain an overview of all tags and constants, double-click on Show all tags in the 
PLC tags folder. 


You can save an incomplete or faulty PLC tag table at any time and process it again 
later. However, the tag table must be error-free to enable compilation of the user 
program. 


6.2.2. Defining PLC tags 


In the Tags tab, enter the name, data type, and address (operand, memory location) 
of the tags used. The name can contain letters, digits, and special characters (no quo- 
tation marks). It must not already have been assigned to a block, a different PLC tag, 
a symbolically addressed constant, or a PLC data type. No distinction is made 
between upper and lower case when checking the name. 


You can add an explanatory comment to each defined tag. Table 6.1 contains the 
operands permissible as PLC tags. 


The definition of a tag also includes the data type. This defines certain properties of 
the data identified by the name, basically the representation of the data content. An 
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Project400 > Distribution control [CPU 412-2 PN] » PLC tags » Conveyor belt [33] — 2@ex 


_)@ Tags |= User constants 


evo THR 4 
Conveyor_belt 
Nome Datatype = Address Retin = Visibleim MN Accessible from MM Comment 

12 a Stop Bool 303 a oz os 
ser Bool wo4 wl ~ Start botton on the operator pane! 
la @ Conmnee 8col “05 “7 w Conte botton on the control panel 
1S <€) Acinowtedge Bool 0.6 a a Acknowledge frorn the operates panel 
1. << Ser tool 107 7] ww Set rignateor operator panel 
Vy << Onsplsy Bult Bool 408.0 ww wa Fault indicanon on the operator pane! 
Th} Display ready Bool *08.1 a o Indicator Ready’ on the operator panel 
1 Belt motor 1 Bool %Q8.2 wl ws Switch_on conveyor belt 1 
20 Belt motor 2 Bee! 5083 ww wa Switeh_on conveyor Belt 2 
Jt 143 Bele moter 3 Bool sQ84 7] a Switch_om conweyor belt 3 

© felt motor « Bool sons wl ~~ Switch_on conveyor belt 4 
23 << Ready tor load Bool ~H20 wl iw Conveyor belt 6 ready for ined 
DE) 43 Readytoeremove — Bool he? 7] a Workpeecet can be removed 
25 Number pieces int sans wl ww Murnber of workpieces 
26 Superson Ter aT2 ww ow Monitonng ome 
27 & Manual mode Bool SME0.D “7 a Manuel mode 
28 4] Avtometx mode tool 0.1 ww wi Automatic mode 
29) -@ Number counter Counter “1 wm a Coumer tor workpieces 
10 3 HQ mode Bool whM0.2 a a 
1 @ Enabling fool wo wl wa 
32 | a) vi = =; | 

il “ . > 


Fig. 6.1 Example of a PLC tag table 


overview of the data types used with a CPU 400 and the detailed description can be 
found in Chapter 4 “Tags, addressing, and data types” on page 89. 


A tick in the Retain column identifies which bit memories, SIMATIC timer and 
counter functions are set to retentive. You set the retentivity in the CPU properties 
in the Retentivity section. 


The properties of a PLC tag include the Accessible from HMI attributes (when acti- 
vated, an HMI station can access this tag during runtime) and the Visible in HMI 
attribute (when activated, this tag is visible by default in the selection list of an HMI 
station). 


Table 6.1 Approved operands and data types for PLC tags 


Operand ID Data types 
Input %ly.x, %IBy, %lWy, %IDy 1 bit: = BOOL 
Output %Qy.x, WQBy, %WQWy, %QDy Sbits: BYTE, CHAR 
] oO oO oO 9 
Bi MIeOLy ably. % EMBY, AMY, eM BY 16 bits: WORD, INT, SSTIME, DATE 
Peripheral input %IBy:P, %lWy:P, %lDy:P 32 bits: DWORD, DINT, REAL, TIME, 
Peripheral output %QBy:P, %QWy:P, %QDy:P TIME_OF_DAY 
SIMATIC timer function %Tn TIMER 
SIMATIC counter function | %Cn COUNTER 


y = byte address, x = bit address, n = number 
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Working with the PLC tag table 


You can use Insert row from the shortcut menu to insert an empty line above the 
selected line. The Delete command deletes the selected line. You can copy selected 
lines and add them to the end of the list. You can sort the lines according to the 
column contents by clicking the header of the appropriate column. Sorting is in 
ascending order following the first click, in descending order following the second 
click, and the original state is reestablished following the third click. 


To fill out the table automatically, select the name of the tag to be transferred, posi- 
tion the cursor at the bottom right corner of the cell, and drag downward over the 
lines with the left mouse button pressed. 


If you enter the same name a second time, for example when copying lines, a con- 
secutive number in parentheses is appended to the name. When filling out auto- 
matically, this is an underscore character with a consecutive number. Double 
assignment of an address is indicated by a colored background. 


You can also supplement, change or delete the PLC tags when entering the user pro- 
gram (Chapter 6.3.6 “Editing tags” on page 266). 


You can compare a PLC tag table with one from another project if you mark the tag 
table and select the command Tools > Compare > Offline/offline. 


6.2.3. Exporting and importing a PLC tag table 


A PLC tag table can also be created or edited using an external editor. The external 
file is present in .xlsx format. 


To export, open the PLC tag table and select the Export icon in the toolbar. Set the 
file name and path in the dialog, and select the data to be exported (tags or con- 
stants). The contents of the opened PLC tag table are exported. To export all PLC 
tags, open the complete table by double-clicking on Show all tags and then select 
the Export icon. 


The external file contains the PLC tags worksheet for the PLC tags and the Constants 
worksheet for the symbolically addressed user constants (Table 6.2). 


Table 6.2 Columns in the external file for the PLC tag table 


Worksheet PLC tags 
Name Path Data type Logical address | Comment | Hmi Visible | Hmi Accessible 
Name of Group and Data type of | Absolute Comment | TRUE or TRUE or FALSE 
PLC tag name of PLC tag | tag address FALSE 

table (e.g. %10.0) 


Worksheet Constants 


Name Path Data type Value Comment 
Name of Group and Data type of | Default value Comment 
constant name of PLC tag | constant 

table 
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To import, double-click on Show all tags under the PLC station in the PLC tags 
folder in the project tree. Select the Import icon in the toolbar. Set the file name and 
path in the dialog, and select the data to be imported (tags or constants). The con- 
tents of the external file are imported into the tag table, which is defined in the col- 
umn Path. Existing entries are identified by a consecutive number in parentheses 
appended to the name and/or by an address highlighted in color. 


6.2.4 Constants tables 


The PLC tag table in the User constants tab contains symbolically addressed con- 
stant values which are valid throughout the CPU. You define a constant in the table 
in that you assign a name, data type, and fixed value to it and you can then use this 
constant in the user program with the symbolic name. 


The constant name must not already have been assigned to a PLC tag, a PLC data 
type, or a block. The name can contain letters, digits, and special characters (but not 
quotation marks). No distinction is made between upper and lower case when check- 
ing the name. 


The object IDs created by the device configuration and the program editor are listed 
in the System constants tab. 


6.3 Programming a code block 


6.3.1 Creating a new code block 


It is only possible to create a new block if a project with a PLC station has been 
opened. You can create a new block in either the Portal view or the Project view. 


In the Portal view, click PLC programming. An overview window appears in which 
you can see the existing blocks. With a newly created project this is the organization 
block OB 1 with the name Main (main program). Click on Add new block to open the 
window for creating a new block. 


In the Project view, the Program blocks folder is present in the project tree under the 
PLC station. This folder is created together with the PLC station. The Program blocks 
folder contains the Add new block editor. Double-click to open the window for creat- 
ing anew block. 


Then select the block type by clicking on the button with the corresponding symbol. 
Assign a meaningful name to the new block. The name must not already have been 
assigned to a different block, a PLC tag, asymbolically addressed constant, or a PLC 
data type. The name can contain letters, digits, and special characters (but not quo- 
tation marks). No distinction is made between upper and lower case when checking 
the name. 


With automatic assignment of the block numbers, the lowest free number for the 
type of block is displayed in each case. If you select the Manual option, you can enter 
a different number (not for organization blocks). 
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Add new block 


- za Tine interrupts Select OB: 
¥ Sy lime of day Lenguege: 
@ 1O0_inv foe 10} 


Description: 
Ornanizrion @ 100 inn [oe 11} 


block » Sy time delay Organization blocks (OBs) are sytem 


~— blocks thet control the program execution. 
> gp Cyclic OBs sllow the program execution to 
respond to cyclic, timeDesed or interrupt- 
driven events. 


Function block 


> Alarming 
> So) Foul interrupts 


Data block 


> Additional information 
(A Add new nnd open 


Fig. 6.2 Add new block window with organization block selected 


Select the programming language for the block. You must assign an event class to an 
organization block, i.e. you define the type of organization block. Select the event 
class from the displayed list (Fig. 6.2). 


You set the default settings when creating a new block in the main menu in the 
Project view using the Options > Settings command in the PLC programming section. 


If the Add new and open checkbox is activated, the program editor is started by click- 
ing on the OK button and programming of the newly created block can begin. 


6.3.2. Working area of program editor for code blocks 


The program editor is automatically started when a block is opened. Open a block 
by double-clicking on its icon: This can be found in the Portal view in the overview 
window of the PLC programming, or in the Project view in the Program blocks folder 
under the PLC station in the project tree. 


You can adapt the properties of the program editor according to your requirements 
using the Options > Settings command in the main menu in the PLC programming 
section. 


The program editor displays the opened block with interface and program in the 
working window (Fig. 6.3). Prior to programming, the block properties are present 
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1400 > Distribution control (CPU 412-2 PN) » Program blocks » 
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Fig. 6.3 Example of the program editor's working window in ladder logic 


in the inspector window; during programming, the properties of the selected or 
edited object are present here. The task window contains the program elements 
catalog in the Instructions task card. 


The program editor's working window shows the following details: 


> The toolbar 
contains the icons for the menu commands for programming, e.g. Add network, 
Delete network, Go to next error, etc. The significance of the icons is displayed if 
you hold the mouse pointer over the icon. Currently non-selectable icons are 
grayed out. 


> The interface 
shows the block interface with the block parameters and the block-local tags. 


> The favorites bar 
provides the favorite program elements (statements), which can also be found in 
the Favorites section of the program elements catalog. You can activate and de- 
activate the display in the editor: Click with the right mouse button in the favor- 
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ites catalog or favorites bar and select or deselect Also display favorites in editor. 
To add a statement to the favorites, select the statement in the program elements 
catalog and drag it with the mouse into the favorites catalog or favorites bar 
(“drag-and-drop”). To remove a statement from the favorites, click with the right 
mouse button and then select Remove statement. 


> The block window 
contains the block program. Enter the control function of the block here. 


The workspace is maximized by clicking on the Maximize icon in the title bar. Click 
on the Embed icon to embed it again. Display as a separate window is also possible: 
Click in the title bar on the icon for Detach. Using the Window > Split editor space 
vertically and Window > Split editor space horizontally commands in the main menu, 
various opened objects can be displayed and edited in parallel, e.g. the PLC tag table 
and a block. 


6.3.3 Specifying code block properties 


To set the block properties, select the block in the Program blocks folder, followed 
by the Edit > Properties command in the main menu or the Properties command in 
the shortcut menu. Block properties which can be changed are the block name, 
block number (not with organization blocks), block title, block comment, block ver- 
sion, block family, creator, and a block ID. 


A block can be protected against illegal access (password protection or “know-how 
protection”). 


There are attributes depending on the type of block, for example the setting for da- 
ta type testing when programming the block. The block properties are described in 
detail in Chapter 5.2.4 “Editing block properties” on page 158. 


6.3.4 Programming a block interface 


The block interfaces of the code blocks contain the declaration of the block-local 
tags. The interface structure depends on the type of block. Table 6.3 shows the in- 
dividual declaration sections of the blocks. The meaning of the declaration sections 
is described in detail in Chapter 5.2.5 “Block interface” on page 162. 


Table 6.3 Declaration sections for code blocks 


Declaration section Meaning Permissible with block type 

Input Input parameter = FC FB 
Output Output parameter = FC FB 
InOut In/out parameter - FC FB 
Static Static local data - - FB 
Temp Temporary local data OB FC FB 
Return Function value * EG - 
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Project400 » Distribution control [CPU 412-2 PN] > Program blocks * Conveyor belt > Counter_control (F816) —. 2M xX 
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Fig. 6.4 Example of function block interface 


You can increase or decrease the size of the block interface window by dragging on 
the bottom edge with the mouse. Two arrows at the bottom can be used to open or 
close the window. Fig. 6.4 shows an example of a function block interface. 


You can click on the triangle to the left of the declaration mode to open the declara- 
tion section or to close it. If you select a line with the right mouse button, you can 
delete it in the shortcut menu, insert an empty line above it, or add an empty line 
after it. 


The name can contain letters, digits, and special characters (but not quotation 
marks). No distinction is made between upper and lower case when checking the 
name. A drop-down list shows the currently permissible data types. You can use the 
comment to describe the purpose of the respective tag. 


The Default value column is displayed for a function block (FB). You can enter a 
default value here which is saved in the instance data block. 


Each organization block (OB) of a CPU 400 provides start information for the user 
program. This start information is present in the first 20 bytes of the declaration 
section Temp. 


In the case of a function (FC), the function value with the name Ret_Val and data 
type VOID is displayed in the interface in the Return section. The function value has 
no significance when programming with LAD, FBD, and STL. The data type VOID 
prevents the display in the call box or call statement. If you specify a different data 
type here, the function value is displayed as the first output parameter. 
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Using the SCL programming language, you can integrate a function in an expres- 
sion instead of a tag with the data type of the function value (see section “Using a 
function value of a function (FC)” on page 167). 


SCL additionally permits an overlay of the tags in the block interface by other data 
types (see section “Overlaying tags (data type views with SCL)” on page 120). 


6.3.5 Programming a control function 


Working with networks 


A network is part of a code block which, in the case of the LAD and FBD program- 
ming languages, contains a complete current path or a complete logic operation. 
The use of networks is optional for STL; it is recommendable to use networks for im- 
proved clarity. SCL and GRAPH do not use networks. 


The program editor automatically numbers the networks starting from 1. You can 
assign a title and a comment to each network. When editing, you can directly select 
any network from the main menu using the Edit > Go to > Network/line command. 


The networks can be opened or closed. To do this, select Network with the right 
mouse button and then select the Collapse or Expand command from the shortcut 
menu, or click in the toolbar of the working window on the Close all networks or 
Open all networks icon. 


When programming the last network in each case, an empty network is automati- 
cally appended. To program a new network, select the Insert > Network command 
from the shortcut menu. The editor then adds an empty network after the currently 
selected network. 


You can show or hide the network comments using the Network comments on/off 
icon in the toolbar or the View > Display with > Network comments command in the 
main menu. 


Program elements catalog 


All program elements permissible for the respective programming language 
(contacts, coils, boxes, statements, etc.) can be found in the program elements cat- 
alog in the task window. The program elements catalog is divided into the following 
groups 


Favorites (frequently required program elements) 
Basic instructions (basic functions) 
Extended instructions (functions implemented by system blocks) 


Technology (technological functions, e.g. for PID controllers or for FM modules) 


Communication (communication functions for data transmission and for 
communication modules) 


262 


6.3 Programming a code block 


You can combine a selection of frequently used program elements in the Favorites 
catalog and display them in the favorites bar of the program editor to allow rapid 
selection. 


General procedure when programming 


To enter the program code, position the program elements in the desired arrange- 
ment and subsequently supply them with tags or enter the statement lines. The 
program editor immediately checks your inputs and indicates faulty entries. 


You can interrupt block programming at any time - even if the program is still 
incomplete or faulty - and continue later. You can store a block by saving the com- 
plete project using the Project > Save command from the main menu. 


You can save the structure of the windows and tables using the Save window settings 
icon in the top right corner of the working window. This structure is reestablished 
the next time the working window is opened. 


Programming a control function with ladder diagram (LAD) 


To program the control function in LAD, select a program element in the catalog 
and drag it with the mouse into the open network under the network comment. The 
first program element is positioned automatically. With the next program element, 
small gray boxes indicate where the new program element may be positioned and 
- in green - where it is positioned when you “let go”. 


In the ladder logic, the binary logic operations are implemented by series and 
parallel connections (Fig. 6.5). With the ladder logic, the Q or ENO output is posi- 
tioned in the display at the top edge of the box in order to be able to “hang” the box 
into the current path. The structure of an LAD current path is described in 
Chapter 7 “Ladder logic LAD” on page 283. 


v Network 43: Representation as ladder logic (LAD) 


#Fan1.works #Fan2.works P_TRIG MOVE 


CLK Q EN ENo-— 
#Display.EM_ 120—IN #Adjustment_ 
#Fant.works #Fan2.works onefen ouTt — value 
#Display-Fault_ 
onefan 
SR "Clock 0,5 HZ #Display.onefan 
s — r-——t r>— 
#Acknowledge 
kK 


Fig. 6.5 Example of ladder logic with contacts, coils, and boxes 
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Programming a control function with function block diagram (FBD) 


To program the control function in FBD, select a program element in the catalog 
and drag it with the mouse into the open network under the network comment. The 
first program element is positioned automatically. With the next program element, 
small gray boxes indicate where the new program element may be positioned and 
- in green - where it is positioned when you “let go”. You can also position program 
elements freely in the network and subsequently connect the corresponding inputs 
and outputs. 


Binary logic operations are represented in the function block diagram by AND, OR, 
and exclusive-OR boxes (Fig. 6.6). The Q and ENO outputs are positioned at the bot- 
tom edge where they can be connected to the input of the following program ele- 
ment. The structure of an FBD logic operation is described in Chapter 8 “Function 
block diagram FBD” on page 315. 


Network 43: Representation as function block diagram (FBD) 


x MOVE 
#Fant1.works — P_TRIG 


#Fan2.works — 3 —  cLK Q 


#Display.EM_ 
onefan 


#Adjustment_ 
EN OUT! — value 
120 — IN ENO— 


#Display.Fault_ 
onefan 


SR 
s & 
#Acknowledge — R1 Qo— #Display.onefan 


“Clock 0,5 HZ — 3¢ — — 


Fig. 6.6 Example of function block diagram with boxes 


Selection of function and data types with drop-down lists (LAD, FBD) 


Many program elements have a variable design with 
regard to both function and data types. For exam- 
ple, if you select the ADD box from the mathemati- 
cal functions, three question marks are shown un- 
derneath the function designation ADD instead of 
the data type. If you click on the ADD box, a small Fig. 6.7 Selection of data type 
yellow triangle is displayed on the top right-hand _ using drop-down list 

corner as an indication that a drop-down list is pres- 

ent behind it. In this case, the drop-down list shows the data types permissible at 
this point, from which you can select the desired data type. 


If a small yellow triangle is displayed in the top right corner of the program element 
(contact, coil, box), you can select a different function here for the program element 
from a drop-down list. 


The empty box - which can be found in the favorites or in the program elements 
catalog under General - is particularly flexible here. Here you can select almost all 
program elements from the (function) drop-down list. 


264 


6.3 Programming a code block 


Programming a control function with statement list (STL) 


The control function is entered in STL line by line. Each line contains one statement. 
You can drag all statements from the program elements catalog into the working 
area. With basic instructions, for example an AND logic operation, it is simpler to 
enter the statements line by line as text. 


Binary logic operations are implemented in the representation as statement list by 
AND, OR, and exclusive-OR logic operations (Fig. 6.8). The statements (operations 
and possibly operands) are written line by line. In the case of block calls and com- 
plex functions implemented as blocks, the block parameters are positioned under- 
neath the call statement. The structure of an STL statement as well as processing of 
the statements are described in Chapter 9 “Statement list STL” on page 348. 


v Network 30: Representation as statement list (STL) 


1 x #Fanl.works 
2 xX #Fan2.works //only one fan works 
3 FP #Display.—EM onefan //rising edge 
4 Ss #Display.Fault_onefan 
5 JCN labell //jump if no edge 
6 L 120 
7 r #Adjustment_value //load value 
labell : A #Acknowledge 
9 R #Display.Fault_onefan 
10 A #Display.Fault_onefan 
11 BR "Clock 0,5 Hz" 
12 = #Display.onefan //display with clock 


Fig. 6.8 Example of representation as Statement List STL 


Programming a control function with Structured Control Language (SCL) 


The control function is entered in SCL as “structured text”. You can drag all state- 
ments from the program elements catalog into the working area. With basic in- 
structions, for example a binary or digital operation, it is simpler to enter the state- 
ments as text. 


Binary and digital logic operations are implemented in the SCL representation by 
expressions (Fig. 6.9). An expression is terminated by a semicolon. In the case of 
block calls and complex functions implemented as blocks, the block parameters are 
listed in parentheses following the function name. The structure of an SCL expres- 
sion is described in Chapter 10 “Structured Control Language SCL” on page 397. 


//Representation as structured control language (SCL) **#####setkedeetedaeeadakekeae eens 
IF (#Fanl.works XOR #Fan2.works) AND NOT #Display.EM onefan THEN 


#Display.Fault_onefan := TRUE; 
216 #Adjustment_value := 120; 

217 | END_IF; 

#Display.EM onefan := #Fanl.works XOR #Fan2.works; 
9 HIF #Acknowledge THEN 

220 #Display.Fault_onefan := FALSE; 


221 | END_IF; 
222 #Display.onefan := #Display.Fault_onefan « “Clock 0,5 Hz"; 


Fig. 6.9 Example of representation as SCL Structured Control Language 
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Programming of control function with sequential control (GRAPH) 


You program a sequence control with the GRAPH language as a sequence of steps, 
transitions, and possibly branches (Fig. 6.10). You can drag all statements (steps, 
transitions, etc.) from the program elements catalog into the working area. The 
programming languages LAD and FBD are available for programming the logic op- 
erations, e.g. for transitions. The structure of a GRAPH sequence control is de- 
scribed in Chapter 11 “S7-GRAPH sequential control” on page 431. 


| Navigation 


t 2 ort ore cow Me ow 
> _Pecmanent pre-instructions (1) Bal ele tal rales 
Sequences (1) $2: Oaves_en 2 
7 tM cutouts nch-on of ming 
> — Interlock 4c) 
P= , Supervision -(v)- 
* = Actions: 
+ 
- ach interlock Event Qualifier Action 
- « 31 3 Sette “MhiLing_arive* 
~ ‘ = 
Sete 
cage cs 
_- air se 
tee te we 
‘ ' 
’ 12 - Switched on: 
| peed reached shpart tensed Rhower wor 
hating 
> Permanent postinstructions (1) v 


> Alarm < > 


Fig. 6.10 Example of representation as sequence control GRAPH 


6.3.6 Editing tags 


Almost all program elements require tags in order to execute their function. Follow- 
ing insertion in the working area, a program element must be supplied with tags. 
Fig. 6.11 shows the insertion of an up/down counter as local instance 
(#IEC_Counter_0_Instance) in a function block. The example shows the representa- 
tion in LAD, FBD, STL, and SCL. 


LAD and FBD indicate with three red question marks that you must enter a tag here. 
If three dots are displayed, supplying a tag is optional. 


If you set the cursor to a block parameter or function parameter in STL, the decla- 
ration mode and the data type of the parameter are shown. 


With SCL, the missing tags are occupied by dummy values which have to be re- 
placed by “real” tags. 


The program editor displays the global tags enclosed by quotation marks. Local 
tags are preceded by a number character (#); if they possess special characters, 
these are additionally enclosed by quotation marks. Operands (absolute addresses) 
are preceded by a percentage sign (%). 
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Supply of an IEC counter function with tags 


Call in LAD Callin FBD 
#IEC_Counter_O_ #IEC_Counter_0_ 
Instance Instance 
cTuD cTuD 
<27.2> Int Int 
-— cu Q—<$—$__—_. <2?.2>—CU 
FALSE — CD QD +... FALSE —= CD 
FALSE —R WV... FALSE —=R QD—... 
<27?> — PV <2??>— PV Qu— 
Call in STL 
1 
2 CALL #IEC_Counter_0 Instance_1 
3 Int 
4 CO 
5 CD := 
6 ee 
7 LD := 
8 i 
=] Qu == 
10 QD = 
11 CV := 
12 
Call in SCL 
239 H#IEC_Counter_0 Instance_1(CU:=_bool_in, 
240 CD:=_bool_in, 
241 R:=_bool_ in, 
242 LD:=_bool_in, 
243 Pv:=_in, 
244 QU=>_bool_out_, 
245 QD=>_bool_out_, 
246 | =>_out_); 
247 


Fig. 6.11 Supply with tags 


You can display the tags with absolute address, symbolic address, or both. The set- 
ting is carried out using the View > Display with > Address information command 
from the main menu, or with the Absolute/symbolic operands icon in the toolbar of 


the program editor. 


The program editor provides support for the input of tags: When you enter the first 
letters of the name of a missing tag, the editor provides a list of (previously de- 
fined) tags which can be considered for the current data type. You can then choose 


the desired tag. 


267 


6 Program editor 


The data type of the tag must correspond to the data type of the supply position. If 
the IEC check attribute is activated in the block, it must be exactly the same data type. 
If the attribute is deactivated, it is sufficient if the tag has the appropriate data width. 


If you enter an operand with the appropriate data width which is not present in the 
PLC tag table, the editor creates a new “Tag_x” in the PLC tag table, with x as a con- 
secutive number. By clicking with the right mouse button on a tag and selecting 
Rename tag from the shortcut menu you can assign a different name to the tag. 
With Rewire tag you can assign a different absolute address to the tag. 


When programming the control function you can also enter the name of a tag which 
does not yet exist. The name of the tag is then underlined in red. By clicking with 
the right mouse button on the undefined tag and selecting Define tag from the 
shortcut menu you are provided with a new window in which you can define the tag 
(Fig. 6.12). You can also select the operand area in which the tag is to be positioned: 
Input, output or in/out parameter, static or temporary local data, bit memories, 
inputs or outputs. 


Define tag 
Name Section Address Datatype PLC tag table Comment 
Part identified [ Global Input |v [961222 Bool =| *| Standard tag ta...» 

Local In 
Local Out 
Local InOut 
Local Static 


Global Input 
Global Output 
Peripheral Input 
Peripheral Output 


Fig. 6.12 Defining tags during program input 


Showing and hiding tag information 


In LAD and FBD, you can display the name, address, and comments of the tags used 
in the network under the current path or the link. The general settings for all blocks 
are made in the main menu with the command Options > Settings in the group PLC 
programming > General. Here you can enable or disable the view with tag informa- 
tion. For the open block - and with the cursor in the program section - select View 
> Display with > Tag information or click in the toolbar of the working window on the 
Tag information on/off icon. 


6.3.7 Working with program comments 


With LAD and FBD as the programming languages, you can enter a “free-form com- 
ment” for each coil or box (LAD) and for each non-binary box (FBD). Right-click on 
the program element and select Insert comment from the shortcut menu. The pro- 
gram editor displays a comment box with an arrow pointing to the selected pro- 
gram element. You can then enter a comment in the box. You can shift the box with- 
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in the network or increase its size using the triangle at the bottom right corner (Fig. 
6.13). 


Comments 


Free comment in LAD Free comment in FBD 
ADD ADD 
Int Int 
ENO ——$<<$—_<———————_ = EN 
#value_1 —IN1 OUT — #result #value_1 —IN1 OUT — $result 
#value_2 — IN2 #value_2 — IN2 —ENO — 


Free-form comment 


for coils and boxes Free-form comment 


for boxes 
4 = __4 


Line comments in STL 


//Line comment as a heading 
L #Value_1 
L #Value_2 
+I 
T #Result //Line comment to end of line 


& ON 


ao wm 


Block comments and line comments in SCL 


i 


//Line comment as a heading 
#Result := #Value_1 + #Value_2; //Line comment to end of line 


uo 


-](* Comment section 


NM NNN NN DY 
Oo 1 ~~) 


Ww 
2 t 


can span several lines *) 


NNN NN ND LY 


Fig. 6.13 Comments in the various programming languages 


With STL as the programming language you enter the comment following a double 
slash up to the end of the line. You can write the comment on its own in a line or 
position it after the STL statement. You can eliminate the comment in a code line by 
positioning the cursor in the line and clicking the Disable code icon in the toolbar 
of the working window. A line comment is then generated with the code line as con- 
tent. You can reverse the procedure using the Enable code icon. 


The programming language SCL provides line and block comments. Line com- 
ments are commenced by two slashes and extend up to the end of the line. A block 
comment is starts with left parenthesis and asterisk and ends with a asterisk and 
right parenthesis. Example: (* This is a block comment *). It can extend over several 
lines. You can eliminate the comment in a code line by positioning the cursor in the 
line and clicking the Disable code icon in the toolbar of the working window. A line 
comment is then generated with the code line as content. You can reverse the pro- 
cedure using the Enable code icon. 
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6.4 Programming a data block 


6.4.1 Creating a new data block 


It is only possible to create a new data block if a project with a PLC station has been 
opened. You can create a new data block in either the Portal view or the Project view. 


In the Portal view, click PLC programming and subsequently Add new block. In the 
Project view, double-click on Add new block in the Program blocks folder. In the 
window for creating a new block, select the icon for Data block. 


Data blocks must be assigned a type: 


> A global data block contains the tags which you specify when programming the 
data block. You can design the contents and structure of the data block as desired. 


> An instance data block contains the block parameters and static local data of a 
function block (FB) or a system function block (SFB). The data structure is de- 
fined during programming of the block interface (for an FB) or is prespecified 
and cannot be changed (for an SFB). 


> A data block with assigned data type (“type data block”) contains the tags with the 
structure of a PLC data type or a system data type. The data structure is defined 
during programming of the PLC data type or is specified by the system data type. 


The Type drop-down list shows the blocks and data types which have already been 
programmed and are thus currently available for use. Select the entry from the list 
with which you wish to structure the data block to be created. Select the Global DB 
entry for a data block whose content you wish to structure as desired. 


Assign a meaningful name to the new block. The name must not already have been 
assigned to a different block, a PLC tag, asymbolically addressed constant, or a PLC 
data type. The name can contain letters, digits, and special characters (but not quo- 
tation marks). No distinction is made between upper and lower case when checking 
the name. 


The language for data blocks is always DB. With the automatic assignment of the 
block numbers, the lowest free number for the type of block is displayed in each 
case; if you select Manual, you can enter a different number. 


If the Add new and open checkbox is activated, the program editor is started by click- 
ing on the OK button, and programming of the newly created block can begin. 


6.4.2. Working area of program editor for data blocks 


The program editor is automatically started when a data block is opened. Open a 
block by double-clicking on its icon: This can be found in the Portal view in the over- 
view window of the PLC programming, or in the Project view in the Program blocks 
folder under the PLC station in the project tree. The program editor's working win- 
dow shows the following details for a data block (Fig. 6.14): 
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Project400 > Examples400 [CPU 412-2 PN] >» Program blocks > Examples.STL » Data.STL (D830) 


ef G86 HEF =a 

Data.STL 
hame Osta type Otfser Start valve Reren Visible in HM Comment 

Q~ Stak “ 

2<4°6s Messages Dword 00 v vv! i 
<a. Mestages_ eM Oword 40 vw ww 

sige Messeges_pos DWord 80 Vv wa 
qj). Messeges_neg DWers 12.0 i MM 

6 @* © Queniy errey [1.4] of ins 160 i) 7] 
“4 a Quantiy{1} Int ‘A a 
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'@Q . Quannty{3} int ¥ v 

oad . Quannty(4) int v v 
42 * © Measurement array [1.4] of int 240 vv vw 

no s Meaturement|t] int ") 7 
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MmqQ . Measurement{?} Int ~ vw 

sao . Measurement{4] int 4 lw 
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Fig. 6.14 Example of the program editor's working window for data blocks 


> The toolbar 
contains the icons for Insert row, Add row, Reset start values, Snapshot of the mon- 
itored values, Monitor all and Expanded mode. The meaning of the symbols is dis- 
played if you hold the mouse pointer over the symbol. Currently non-selectable 
icons are grayed out. 


> The tag declaration 
shows the contents of the data block. 


The working area can be maximized by clicking on the Maximize icon in the title bar, 
and embedded again using the icon for Embed. Display as a separate window is also 
possible: Click in the title bar on the icon for Float. 


You can save the structure of the windows and tables using the Save window settings 
icon in the top right corner of the working window. This structure is reestablished 
the next time the working window is opened. 


6.4.3 Defining properties for data blocks 


To set the block properties, select the block in the Program blocks folder, followed 
by the Edit > Properties command in the main menu or the Properties command in 
the shortcut menu. Block properties which can be changed are the block name, 
block number, block title, block comment, block version, block family, creator, and 
a block ID. A data block can be protected against illegal access (know-how protec- 
tion). 


Attributes also exist depending on the block type, for example the setting for write 
protection. The block properties are described in detail in Chapter 5.2.4 “Editing 
block properties” on page 158. 
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6.4.4 Declaring data tags 


The declaration table shows the following columns depending on the block proper- 
ties and the editing environment: 


D> 


Name: The name can contain letters, digits, and special characters (but not quo- 
tation marks). No distinction is made between upper and lower case when check- 
ing the name. The name is block-local, and therefore the name can also be used 
in other blocks for different tags. In association with the data block whose name 
applies throughout the CPU (globally), a data tag becomes a “global” tag appli- 
cable throughout the CPU. 


Data type: Select the data type of the tag from a drop-down list, or enter it directly. 


Offset: The offset shows — following compilation - the relative address of the tag 
at the beginning of the data block. 


Default: The default is the value which is automatically assigned to a new tag 
depending on the data type. Example: With the data type DATE, the default value 
is DATE#1990-01-01. If the data block is based on a data type (type data block) or 
a function block (instance data block), the tag value defined in the data type or 
in the function block is present in the Default column. 


Start value: The Start value column lists the individual default values of the tags 
for this data block. The default value is used if a start value is not entered. The 
start value is the value with which the data block is loaded into the CPU's work 
memory. With an instance data block it is then possible, for example, to com- 
mence each call (each instance) with different start values. 


Snapshot: The Snapshot column shows the “frozen” monitoring values from the 
work memory at the time of the snapshot. 


Monitor value: The monitoring value indicates the actual values of the tags in on- 
line mode. This is the value present when the work memory is scanned. This col- 
umn is only displayed in Monitoring mode. 


Retain: A tick in this column indicates that the tags in the data block are reten- 
tive. The setting applies to the complete data block. 


Visible in HMI: A tick in this column means that the tag is visible in the selection 
list of HMI stations by default. 


Accessible from HMI: Indicates whether an HMI device can access this tag (only 
with S7-1200). 


Comment: The comment allows input of an explanation of the purpose of the 
tag. 


You can determine the columns to be displayed yourself: Right-click in the line with 
the column headers and then select the Show/hide columns > ... command from the 
shortcut menu. You can then select or deselect the columns to be displayed. 


Expanded mode 


The expanded mode is activated using the Expanded mode icon in the toolbar of the 
working window. In expanded mode, all tags with data types ARRAY and STRUCT as 
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well as the PLC data types are “opened” so that the individual components can be 
displayed and - if permissible - assigned default values. 


6.4.5 Entering data tags in global data blocks 


With a global data block, you enter the data tags directly in the block. In the Name 
column you specify the name of the tag. Following input of the name, select the data 
type from a drop-down list, enter a start value if applicable, and use a comment to 
explain the purpose of the tag. 


With the STRING data type, enter the maximum length of the string in square brack- 
ets. If this data is missing, the standard length of 254 characters is used. 


With the ARRAY data type, you must enter the range limits and the component data 
type. For example, the information in the drop-down list Array [lo .. hi] of type could 
then result in Array [1 .. 12] of Real. If you click on the triangle to the left of the tag 
name, the components are displayed, and you can assign individual start values to 
them as default values. 


Select the STRUCT data type from the drop-down list and, in the line under the tag 
name, enter the name of the first component, its data type, possibly a default set- 
ting, and a comment. The next line contains the second component, etc. 


The drop-down list also shows the previously defined PLC data types which you can 
also assign to a data tag. 


6.5 Compiling blocks 


Compilation generates a program code which can execute in the CPU. A compilation 
process is always triggered prior to downloading the user program to the PLC station. 
Only blocks which have been compiled without errors can be downloaded. 


It is recommendable to also trigger compilation while generating the user program 
to enable a quick response to any programming errors. 


6.5.1 Starting the compilation 


You start the compilation using a command from the shortcut menu. 


> Tocompile a block opened in the program editor, click with the right mouse button 
on the white background of the working area and select the Compile command. 


> To compile a block listed in the call structure or in the dependency structure, 
click with the right mouse button on the block and select the Compile command. 


> To start the compilation process for the selected block, right-click a block in the 
Program blocks folder in the project tree followed by the Compile > Software com- 
mand. 


> You can also select several blocks in the Program blocks folder and compile them 
together using the Compile > Software command from the shortcut menu. 


273 


6 Program editor 


> You can compile the entire user program by selecting the Program blocks folder 
followed by Compile > ... from the shortcut menu. You then have the choice 
between ... Software (compile program changes since last compilation only) and 
... Software (rebuild all blocks) (compilation of entire program). 


> Ifyou select the PLC station folder and then Compile >... from the shortcut menu, 
you can select between 


- ... All (complete compilation of all project information relevant to execution) 
— ... Hardware (compilation of device and network configuration) 
- ... Software (compilation of program changes since last compilation only) 


- ... Software (compile all blocks) (compilation of entire user program) 


The result of the compilation is displayed in the inspector window in the Info tab un- 
der Compile (Fig. 6.15). Any warnings which have been detected do not prevent con- 
tinuation of the compilation. Any errors which have been detected are displayed in 
the result of the compilation, and end the compilation. 


General Cross-references Compile Syntax 
Compiling completed (errors: 4; warnings: 1) 

! Path Description Errors = Warnings 
iv) Distance_belt2 (FC212) Block was successfully compiled. 0 0 
(x) ~ Distance_belti (FC211) 1 0 
[x] Network 1 The data type Dint of the actual parameter does notmatcht. 2 1 0 
(x) ~ Conveyor_belt (FB10) 1 it) 
[x] Network 6 Tag “Belt motor 5° not defined. ?1 it) 
@ Status (FB210) Block was successfully compiled. 0 0 
iv} Conveyor_belt_DB (DB10) Block was successfully compiled. O oO 
iv} Status_DB (DB210) Block was successfully compiled. i) i) 
iv} Motor_control_2 (FC202) fy) i) 
(x) ~ Distance_beltt (FC211) 1 fy) 
(x) Network 1 The data type Dint of the actual parameter does notmatcht. 2 1 is) 
(x) ~ Conveyor_belt (FB10) 1 0 
[x] Network 6 Tag “Belt motor 5" not defined. ?1 i) 
A ~ General warnings ti) 1 
AL Inputs or outputs are used that do not exist in the configured h.. 0 1 
[XE Compiling completed (errors: 4; warnings: 1) 1 te) 


a 
a 

2 
> 
= 
o1 


Example of compilation information in the inspector window 


6.5.2 Compiling SCL blocks 


You can set the attributes for compilation in the properties of SCL blocks. The set- 
ting for all newly created blocks is specified in the main menu under Options > 
Settings and PLC programming > SCL > Compile. 


> Create extended status information 
permits monitoring of all tags in a block. 


> Check ARRAY limits 
checks the limits of ARRAY tags during runtime and sets ENO to signal state “0” 
in the event of a limit violation. 
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6.5 Compiling blocks 


> Set ENO automatically 
checks whether errors have occurred in program execution during runtime and 
sets ENO to signal state “O” in the event of an error. 


Activation of one of the attributes increases the memory requirements and pro- 
cessing time of the block. 


6.5.3 Eliminating errors following compilation 


An error is indicated by a white cross on a red circle in the line of the faulty block. 
Click on the triangle to the left of the block name to open the list with the compila- 
tion messages. 


Click on the blue question mark in an error message to display more information 
about the error. Double-clicking on an error message displays the program envi- 
ronment of the selected error in the working window so that you can correct the 
error directly. 


Correcting a faulty block call 


During the compilation, the program editor checks whether the supply of block 
parameters present in the calling block agrees with the interface of the called block. 


If you double-click on the error message, the program editor opens the network 
with the faulty call. You can then correct the call, for example by entering missing 
actual parameters or by using actual parameters with the correct data type. If the 
block call is displayed with a red border, select the Update block call command from 
the shortcut menu. The program editor suggests a modified block call in the 
Interface update window which you can import unchanged or following modifica- 
tion (Fig. 6.16). 


Under Options > Settings and PLC programming > General > Compilation you can 
select the Delete actual parameters on interface update option. The result is that an 
actual parameter is deleted when compiling or updating the interface if the 
associated block parameter has been deleted. 


Interface update fx 


Old interface: New interface: 


ENO 


“Monitoring data”. 
Voltage_belt[1] Voltage 


“Monitoring data*. 
Power|~ Power_belt(1] 


“Monitoring data*. 
Power — Power_belt(1] 


“Monitoring data”. 
“Monitoring data". Voltage_belt{1] — Voltage “Monitoring data”. 


“Monitoring data”. 


Current_belt{1] 4 Current Runtime }— Duration_belt[1] Runtime — Duration_belt[1] 


“Monitoring data”. 
Current_belt[1] — Current 


[s] i >|[< i >] 


——x—] | Cancel 


Fig. 6.16 Interface update in the case of faulty block calls 
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6.6 Program information 


The following tools support you during programming and program testing: 


> Cross-references 


> Assignment list for inputs, outputs, bit memories, SIMATIC timer and 
counter functions 


> Call and dependency structures 


> Resources 


You can start the individual tools at any time during programming, either in the 
main menu using the Tools > ... command or in the project tree by double-clicking 
Program info under a PLC station. Following commissioning, the program informa- 
tion can be part of the project documentation. 


6.6.1 Cross-reference list 


The cross-reference list indicates the use of tags and blocks in the user program. It 
provides an overview of 


> Which objects have been used 
> At which position in the program they have been used 


> In what association they have been used, e.g. with which function a tag 
has been used 


You can create cross-references from any data object of a station: Select the station, 
a folder under the station, or one or more objects in a folder, e.g. one or more blocks 
or PLC tags, and then select the Cross-references command from the shortcut menu 
or the Tools > Cross-references command from the main menu. The cross-reference 
list is available in two views: Used by and Uses. 


Cross-reference list Used by 


The Used by view is based on the referenced object. It shows the positions at which 
the object present in the first column is used (Fig. 6.17). For example, all the posi- 
tions of where a block is called are shown, or all the program positions at which a 
tag is used. If the list entries are opened, a link in the Point of use column leads di- 
rectly to the program position at which the object is used. You can select the view 
options using the spanner icon in the toolbar of the cross-reference list: Show used 
and/or Show unused. 


Cross-reference list Uses 


The Uses view displays the objects used by the referenced object. It shows which 
objects are used (Fig. 6.18). With a block, for example, it shows which blocks are 
called within it and which tags are used within it. If the list entries are opened, a link 
in the Point of use column leads directly to the program position at which the asso- 
ciated object is used. You can select the view options using the spanner icon in the 
toolbar of the cross-reference list: Show defined and/or Show undefined. 


276 


6.6 Program information 


Project400 » Distribution control [CPU 412-2 PN] >» S7-400-Station_1 


era 
Cross-references of: Clock 2 Hz, Automatic mode, Manual mode 
| Used by Uses 


Object Num... Point of use as Access Address Type Path 
<Q Automatic mode %M40.1 Bool Project400\Distributi 
wy Clock 2 Hz %M99.5 Bool Project400\Distributi 
> @RHydraulic_control 1 FC204 FBD-Function Project400\Distributi 
> i Motor_control_1 1 FC201 $TLFunction — Project400\Distributij 
> 2 Motor_control_2 1 FC202 SCLfunction Project400\Distributi 
yy Power_control 1 FC205 LAD-Function Project400\Distributi 
Power_control NW1 Read-only 
vy <Menual mode %M40.0 Bool Project400\Distributi 
y BHydraulic_control 1 FC204 FBD-Function Project400\Distributi 
Hydraulic_control NW2 Read-only 
2 Motor_control_i 1 FC201 SiLFunction Project400\Distributi 
Motor_control_1 NW2 Read-only 
> i Motor_control_2 1 FC202 $CLFunction Project400\Distributij 
> 2iPower_control 1 FC205 LAD-unction Project400\Distributij 


me < a [>] 


Fig. 6.17 Example of a cross-reference list in the Used by view 


..dject400 > Distribution control [CPU 412-2 PN] > Program blocks > Conveyor belt » Conveyor_control [FB17] — 12 MX 


ew: 
Cross-references of: Conveyor_control 
Used by Uses 


Object Num... Point of use as Access Address Type Path 

>» <#Load 4 Bool Project «| 

> <QJ#EM_load_pos 1 Bool Project 

>» <#Ready load 1 Bool Project 

>» <i#Ready remove 1 Bool Project 

>» <Q#EM_remove_neg 1 Bool Project 

vy WB Belt_control 5 FB15 LAD-Func... Project 
Conveyor_control NW6 Call 
Conveyor_control NW6 Call =] 
Conveyor_control NW6 Call 
Conveyor_control NW6 Call 
Interface Belt_control_Instance Multiple i... 

~ 2 Counter_control 2 FB16 LAD-Func.... Project 
Conveyor_control NWS #Counter_control_Instance Call 
Interface Counter_control_Instance Multiple i_.. 

vy Enable 2 %M32.0 Bool Project 
Conveyor_control NW... Read-only | 
Conveyor_control NW... Read-only ik 

_£ tm [>] 


Fig. 6.18 Example of a cross-reference list in the Uses view 


Display of cross-references in the inspector window 


Select an object, e.g. a block in the project tree or a tag in the working window, and 
then select the Cross-reference information command in the shortcut menu. The in- 
spector window - under Cross-references in the Info tab —- shows the program posi- 
tions at which the selected object has been used. If the cross-reference list is open 
in the inspector window, the use of the selected object is displayed directly. 
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6 Program editor 


6.6.2 Assignment list 


The assignment list shows the assignment of the operand areas: inputs (I), outputs 
(Q), bit memories (M), SIMATIC timer functions (T), and SIMATIC counter functions 
(C). The use of operands as bit, byte, word or doubleword operands or tags is dis- 
played. Peripheral inputs are assigned to the inputs operand area, and peripheral 
outputs to the outputs operand area. 


You can display the assignment list for individual blocks or for the entire program: 
Select the blocks, the Program blocks folder or the folder of the PLC station, and 
then select Assignment list from the shortcut menu or Tools > Assignment list in the 
main menu (Fig. 6.19). 


Project400 » Distribution control [CPU 412-2 PN] 


= Assignment list |i) Resources 


a 


fs] Call structure || | Dependency structure 
Co Ss | No filter> ~| Y og a 
Assignment list of Distribution control 
Ms Input, Output = Memory 
Address 765432108 W DW Address 7 (6 }5-j4 5342515018 
1B0 o © 4 MB32 oo 04 
IB10 i | il MB33 | 


SEEEEEEE 
B11 [a | | MB34 
QB0 Hi > MB35 
Bt I alate | MB40 
QB3 i EEBEEES MB41 
QB7 eH MB44 
aps Beas MB45 
MB96 


MB97 
MBS9 


Fig. 6.19 Example of an assignment list with inputs, outputs, and bit memories 


Display of input/output assignment 


A yellow background for inputs and outputs (in the left window, Fig. 6.19, grey 
background for the diamonds) indicates that the address is not used by the hard- 
ware or that no hardware has been configured for this address. If you additionally 
address a bit in a byte, word or doubleword operand, the entry has a gray back- 
ground. You can use the View options icon in the toolbar of the assignment list to 
select whether the used addresses and/or the free hardware addresses are to be dis- 
played. 


Display of bit memory assignment 


The view option must be set to Used addresses in order to display the bit memory 
assignment. For the bit memories, symbols with the operands indicate up to what 
address the bit memories are retentive. 
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6.6 Program information 


Display of timer and counter assignments 


Use of the SIMATIC timer and counter functions is displayed in decades. All timer 
and counter operations are considered, e.g. also the scanning of a duration or the 
counter status. 


Filter 


You can filter the display of the assignment list using the Filter icon in the toolbar. 
You specify which addresses (operands) you want to view: To select the operand 
area, activate the associated checkbox. You can select all addresses as the filter area 
(with an asterisk: *), a section of the address area using a hyphen (e.g. 0-100), an 
individual address (e.g. 101) or several areas, separated by a semicolon (e.g. 0-100; 
120-124; 160). 


If you wish to repeatedly use the particular settings of a filter, assign aname to the 
settings in the drop-down list of the filter dialog. You can then use this name to re- 
call the filter settings from the drop-down list in the toolbar of the assignment list. 
You can also delete filter names again. 


6.6.3 Call structure 


The call structure describes the call hierarchy of the blocks. To display the call 
structure, first select the PLC station or Program blocks folder for the entire pro- 
gram or for individual blocks, and then select Call structure from the shortcut 
menu or Tools > Call structure from the main menu. 


The call structure shows the used blocks and the code blocks called from these 
blocks or the data blocks used in them (Fig. 6.20). The blocks which are not called 


Project400 » Distribution control [CPU 412-2 PN] 


| Call structure | Dependency structure | =] Assignment list || lil) Resources 


C:% = 
Call structure of Distribution control 
Call structure ! Address Details 
~ Main OB1 
~ UH Conveyor_belt, Conveyor_belt_DB FB10, DB10 Main NW2 
> 3 Belt_control, Belt1 j FB15, DB101 Conveyor_belt NW3 
> i Belt_control, Bett_2 FB15, DB102 Conveyor_belt NW4 
> i Belt_control, Belt_3 FB15, DB103 Conveyor_belt NWS 
~ BM Belt_control, Belt_4 FB15,DB104 — Conveyor_belt NW6 
3 Drive_monitoring FC178 Belt_control NW4 (Block end) 
2 Power_Monitoring FC172 Belt_control NW4 (Block end) 
3% Conveyor_load, #Conveyor_load [3 FB14 Interface 
3 Conveyor_load, #Conveyor_load = FB14 Conveyor_belt NW2 
3 Counter_control, #Counter_cont... & FB16 Conveyor_belt NW7 
3% Counter_control, #Counter_cont... FB16 Interface 
> i} Status, Status_DB : FB210, DB210 Main NW1 
» Belt_control_DB (instance DB of Belt_cont... DB1s 


Ml 


Fig. 6.20 Example of call structure 
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6 Program editor 


in the user program are present in the first level (color highlighted) - in the fin- 
ished program, these should only be the organization blocks. 


Starting with the call structure, you can display the cross-reference information or 
open a block for processing with the program editor. The consistency test for the 
block calls is described in Chapter 6.6.5 “Consistency check” on page 281. 


You can set the view options using the View options icon in the toolbar: Show con- 
flicts only then displays the call paths in which conflicts have been detected, e.g. in- 
terface conflicts, recursive calls, or non-existent block calls. Group multiple calls to- 
gether displays several calls of a block or data block access operations in a single 
line, and specifies the number of calls in a separate column. 


For compiled blocks, the memory requirements for temporary local data of a block 
and in the path are displayed. 


6.6.4 Dependency structure 


The dependency structure shows the dependencies of each block. To display the 
dependency structure, first select the PLC station or Program blocks folder for the 
entire program or for individual blocks, and then select Tools > Dependency 
structure from the main menu. 


For each code block the dependency structure shows the block from which it is 
called, and for each data block the code block in which it is used (Fig. 6.21). 


From the dependency structure, you can display the cross-reference information or 
open a block for processing with the program editor. The consistency test for the 
block calls is described in the next Chapter 6.6.5 “Consistency check” on page 281. 


Project400 » Distribution control [CPU 412-2 PN] 


fs] Call structure | Dependency structure = Assignment list || li] Resources 


Sa:uz 


Dependency structure of Distribution control 
Dependency structure ! Address 
> gg Distance_counter (instance DB of CTU_S... DB219 
3 Power_Monitoring FC172 
~ 3 Belt_contro! FB1S Belt_control NW4 (Block end) 
~ @ Belt_1 (instance DB of Bett_control) DB101 
~ i Conveyor_bett FB10 Conveyor_belt NW3 
> @ Conveyor_belt_DB (instanc... (3) DB10 
a Main OB1 Main NW2 
3% Conveyor_contro! FB17 Conveyor_control NW6 
@ Belt_2 (instance DB of Bett_control) (3) DB102 
@ Belt_3 (instance DB of Bett_control) (3) DB103 
@ Belt_4 (instance DB of Bett_control) (3) DB104 
@ Belt_control_DB (instance DB of B... DB15 
3 Conveyor_bett FB10 Conveyor_belt NW3 
3 Conveyor_belt FB10 Conveyor_belt NW4 
3 Conveyor_bett FB10 Conveyor_belt NWS 
3 Conveyor_belt FB10 Conveyor_belt NW6 
3 Conveyor_control (instance DB of... (3) Interface 


Fig. 6.21 Example of dependency structure 
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6.6 Program information 


You can set the view options using the View options icon in the toolbar: Show 
conflicts only then displays the call paths in which conflicts have been detected, e.g. 
interface conflicts, recursive calls, or non-existent block calls. Group multiple calls 
together displays several calls of a block or data block access operations in a single 
line, and specifies the number of calls in a separate column. 


6.6.5 Consistency check 


Clicking on the Consistency check icon in the toolbar displays block calls with an 
“interface conflict”. These are calls of blocks whose interface has been subsequently 
changed e.g. by assignment of a different data type to a block parameter or by mod- 
ification of the static local data for function blocks. 


Blocks which have not yet been compiled following a modification are displayed 
with a red border. In order to compile individual blocks in the call or dependency 
structure, select Compile in the shortcut menu. 


If interface conflicts cannot be eliminated by a repeated compilation, they must be 
handled manually. The link in the Details column leads to the faulty block call. 


Open the calling block, select the block call identified as faulty, and select the 
Update call block command from the shortcut menu. When updating the call block, 
the program editor shows what the updated call block will look like in the Interface 
update window. You can then carry out corrections and supplements in this 
window, for example if a new block parameter has been added. 


6.6.6 Memory utilization of the CPU 


Under Resources you can see the assignment of the user memory and of the exist- 
ing input/output modules (Fig. 6.22). To display the resources, first select the PLC 
station, Program blocks folder or individual blocks, and then select the Tools > 
Resources command from the main menu. 


Project400 > Distribution control [CPU 412-2 PN] —_- =x 


) Call structure | Dependency structure | Assignment list | Li] Resources | 


Ls 
Resources of Distribution control 


Objects Load memory Work memory Retentive memory ie} ol DO Al AO 
1 18.75% 34.38% —% —% 
3 Total: - - - Configured: 16 32 oO 0 
4 Used: 5850 bytes 3516 bytes 210 bytes Used: 3 "1 0 0 
5 Details 
6 > OB 180 bytes 106 bytes 
7] > Fc 1778 bytes 1184 bytes 
8 > FB 2322 bytes 1584 bytes 
9 |> vB 1570 bytes 642 bytes 210 bytes 
10 Data types = a 
11 PLC tags 0 bytes 


Fig. 6.22 Example of display of memory utilization 
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6 Program editor 


The memory utilization shows in four columns the maximum available and actually 
used RAM and EPROM load memory and work memory for code and data. You can 
see the utilization for each type of block, for individual blocks and for the PLC tags. 
Question marks represent blocks which have not yet been compiled. The values are 
then displayed in red in the total lines. 


The existing (configured) input/output modules are divided according to DI, DO, AI 
and AO, together with information on how many of them are used in the program. 
Starting with the resources function, you can display the properties ofa marked block 
in the inspector window or open a block for processing with the program editor. 


282 


7.1 Introduction 


7 Ladder logic LAD 


7.1 Introduction 


This chapter describes programming with ladder logic. It provides examples of how 
the programming functions are represented in LAD. You can find a description of 
the individual functions, e.g. comparison functions, in Chapters 12 “Basic func- 
tions” on page 461, 13 “Digital functions” on page 507, and 14 “Program flow con- 
trol” on page 560. 


Use of the program and symbol editor, which generally applies to all programming 
languages, is described in Chapter 6 “Program editor” on page 253. 


LAD is used to program the contents of blocks (the user program). What blocks are, 
and how they are created, is described in Chapters 5.2.3 “Block types” on page 156 
and 6.3 “Programming a code block” on page 257. 


7.1.1 Programming with LAD in general 


You use LAD to program the control function of the programmable controller - the 
user program (control program). The user program is organized in different types 
of blocks. A block is divided into sections referred to as “networks”. Each network 
contains at least one current path which may also have an extremely complex struc- 
ture. Each network is terminated by at least one coil or box. 


Fig. 7.1 shows the structure of a block with the LAD program. The block header 
(block title) and the block comment are located at the beginning of the program. 
Heading and comment are optional. These are followed by the first network with its 
number, heading, and comment. Heading and comment are also optional for the 
networks. The first network shows a current path as an example with series and 
parallel connection of contacts, amemory function within the current path, and two 
coils as termination of the current path. The second network shows the processing 
of boxes, which can be arranged in series or parallel. A block is not terminated by a 
special network or function, you simply finish the program input. 


The LAD editor establishes a network in accordance with the principle of the “main 
current path”: this is the highest branch which commences directly on the left-hand 
power rail and must be terminated by a coil or box. All LAD elements can be posi- 
tioned within it. 


An LAD element must not be “short-circuited” by an “empty” parallel branch, and 
“current” must not flow from right to left through a program element. A parallel 
branch which does not end “open” must be closed for the branch on which it was 
opened. 
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7 Ladder logic LAD 


..400 > Examples400 [CPU 412-2 PN] > Program blocks >» Examples.LAD > Examples.LAD [FB11] — HZ X 


4b 4b ~~ + 


y Blocktitle: Example of representation of programming language LAD (ladder diagram) a 


-w Network 1 shows a combination of binary operations. 
Network 2 contains an example of the digital functions. 


v Network 1: Example of representation of binary operations and memory functions 


wv The network contains an SR memory whose set input is controlled bya combination of series and 
parallel connections and whose reset input is preceded bya parallel connection of contacts. The 
output of the SR memory is connected in series with a contact and to two coils. 


*Switch-on_ #Motor_memory 
manual” “Manual_mode* SR #Enabling *Motor_start® 


-K—————I s ga—4 — 
*Switch-on_ “Motor_display” 
automatic” “Manual_mode* | ead 
*Switch-off_ 

manual” 
RI 


“Switch-off_ 


automatic” The command memory for the 


motor control remains set even if 
the enable is missing. a 


“Motor_fault™ 


v Network 2: Representation of digital functions 


~ Acorrection value is added to a position value, and the result compared with a limit switch 
position. A fault bit is set and latched if the limit position is exceeded. 


ADD ape aca “Position_fault® 
= switc SR 
<= 
= EN ENO ——_ pat |— s Qa 
#Position_value — IN1 OUT- #temp_dint #temp_dint 


#Adjustment_ 
value — IN2 


#Acknowledge 


-#————qjqK 


= 100% |e) 8s 


Fig. 7.1 Structure of a block with LAD program 


“Open” parallel branches can lead out from the main current path and need not 
lead back to the main current path; these are known as “T branches”. There are cer- 
tain limitations in the selection of the permissible program elements in the case of 
these parallel branches which do not commence on the left-hand power rail. 
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7.1 Introduction 


Where additional rules apply to the arrangement of special LAD elements, these are 
described in the corresponding sections. 


7.1.2 Program elements of ladder logic 


Fig. 7.2 shows which types of LAD elements exist: Contacts and coils for processing 
binary signals, Q boxes for implementing memory, timer, and counter functions, 
and EN/ENO boxes for “complex” functions which, for example, carry out calcula- 
tions, manipulate strings, or convert numbers into text. 


Most program elements must be provided with tags or operand addresses. With 
contacts and coils, the tags are assigned by means of the program element. If fur- 
ther tags are required for the function, these are present under the element. In the 
case of the boxes, the tags are present at the box inputs and outputs. 


It is best if you initially arrange all program elements in a current path and subse- 
quently label them. 


Contacts 


The binary control function is implemented by the arrangement of contacts. 


Binary tag Standard contacts scan the signal state of a binary tag. There are also 
contacts with special functions such as edge evaluation ("fleeting contact") or 
| the comparison of two digital tags which delivers abinary result. 


Coils 


The coils process the binary result of the logic operation. They can be 


Binary tag positioned in the middle or at the end of a current path. Standard coils save 
the result of the logic operation in binary tags. There are also coils with 
( } special functions such as edge evaluation ("pulse flag") or the control of 


SIMATIC timer and counter functions. 


Boxes with Q output 


"Simple" functions are shown as boxes with a Q output ("Q boxes"). These can 


Function have multiple inputs, as well as extra outputs in addition to the Q output. 
— INI Q— Examples of these boxes are the memory functions and the timer and 
ie counter functions. 


Boxes with EN input and ENO output 


Processing of these boxes can be enabled by means of the enabling input EN. 


Function The enabling output ENO signals whether processing has been completed 
— EN ENO — _ withouterrors. The boxes can have multiple inputs and outputs. Examples of 
—IN1 ouln— these boxes are the math functions or the functions for conversion of the 
data type of tags. 
— IN2 
Block calls 
Data The block calls represent the change in processing to a different block. 
Block The box represents the called block with its input and output parameters. 
The block called with the box is processed; processing is subsequently 
— EN ENO —— continued with the next function following the block call. 
—IN1 OUT1 — 
— IN2 OUT2 — 


Fig. 7.2 Overview of ladder logic program elements 
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7 Ladder logic LAD 


7.2. Programming binary logic operations with LAD 


In the case of contacts you scan the binary tags, e.g. inputs, and link the scanned 
signal states by arranging the contacts in series or parallel. You use an NO or NC 
contact to define the influence of the scanned signal state on the logic operation. 
Further functions for contacts are negation of the signal flow, edge evaluation for a 
binary tag, and the comparison function (Fig. 7.3). 


Normally open contact Normally closed contact NOT contact 


Binary tag Binary tag 


Positive edge of binary tag Negative edge of binary tag Comparison function 
Binary tag Binary tag Digital tag 1 
Function 
. N Data type 
Edge trigger flag Edge trigger flag Digital tag 2 


Fig. 7.3 Overview of the contacts described in this chapter 


7.2.1 NO and NC contacts 


An NO or NC contact is used to scan the signal state of a binary tag. An NO contact 
passes on the scanned signal state directly to the logic operation, an NC contact first 
negates the signal state. 


To program a contact, drag it with the mouse from the program elements catalog 
under Basic instructions > Bit logic operation to the working area. You can subse- 
quently change the function (NO or NC contact) using a drop-down list which you 
can open using the small yellow triangle when the contact is selected. 


You write the binary tag to be scanned above the contact. This can be an input, out- 
put, bit memory or data bit, or also a SIMATIC timer or counter function. Assign- 
ment with a constant (TRUE or FALSE) is not permissible. 


The example in Fig. 7.4 shows the two “Start” and “Stop” pushbuttons. When 
pressed, they output the signal state “1” in the case of an input module with sinking 
input. The SR function is set or reset with this signal state. 


The “/Fault” signal is not active in the normal case. Signal state “1” is then present 
and is negated by scanning with an NC contact, and the SR function therefore 
remains uninfluenced. If “/Fault” becomes active, the SR function is to be reset. The 
active signal “/Fault” delivers signal state “0”, which resets the SR function by 
means of the scan with an NC contact as signal state “1”. 
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7.2 Programming binary logic operations with LAD 


Example of application of NO and NC contacts 


L+ "Start" "Stop" "Fault" When pressed, the "Start" and "Stop" 
keys switch the fan on and off. 
They are "1-active" signals. 


If "Fault" becomes active, the fan is 
to be switched off and remain off. 
"Fault" is a"0-active" signal. In order 
- to reset the SR function with signal 

: state "1", this input is scanned with 

: an NC contact (scan for signal 

: state "0"). 


- In the example, the 0-active signal 


- is identified by a slash in front of 
- the name. 


Fig. 7.4 Principle of operation of NO and NC contacts 


7.2.2 Series and parallel connection of contacts 


With a series connection, two or more contacts are positioned one behind the other. 
Current flows through a series connection when all contacts are closed (“AND func- 
tion”, see Chapter 12.1.3 “AND function, series connection” on page 464). 


A parallel connection means that two or more contacts are positioned underneath 
each other. Current flows through a parallel connection when one of the contacts is 
closed (“OR function”, see Chapter 12.1.4 “OR function, parallel connection” on 
page 465). 


Series and parallel connections can be combined. If contacts arranged in parallel 
are connected in series to other contacts arranged in parallel (series connection of 
parallel connections), this corresponds to an AND logic operation on OR functions. 
An OR logic operation on AND functions is the parallel connection of series connec- 
tions. 


To program a branch, use the mouse to drag the symbol for Open branch or Close 
branch from the program elements catalog under Basic instructions > General into 
the current path. Gray boxes indicate the permissible positioning, a green box iden- 
tifies the position at which the branch will be opened or closed if you release the 
mouse button. You close a branch if you drag the end of the branch to the position 
at which it is to be closed. 


Fig. 7.5 shows a simple example of the interconnection of contacts. Two fans signal 
with signal state “1” that they are running. A coil is to be activated for display is only 
one fan is running. The logic operation in network 3 is: (#Fan1.works AND not 
#Fan2.works) OR (not #Fan1.works AND #Fan2.works). Network 4 solves the task 
with the logic operation (#Fan1.works OR #Fan2.works) AND (not #Fan1.works OR 
not #Fan2.works). 
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v Network 3: Display when only one fan is running (1) 


#Display.onefen_ 
#Fant.works #Fan2.works 1 


#Fant.works #Fan2.works 


v Network 4: Display when only one fan is running (2) 


#Display.onefan_ 
2 


'’—_ 


#Fant.works #Fant.works 


#Fan2.works 


Fig. 7.5 Example of series and parallel connection of contacts 


7.2.3. T branch, open parallel branch 


You can “divide” a current path so that it has two different terminations. If this is 
not simply a parallel connection of coils or boxes, but a case of both branches hav- 
ing different logic operations, this is referred to as a “T branch” or an “open” paral- 
lel branch. 


To program aT branch, use the mouse to drag the symbol for Open branch from the 
program elements catalog under Basic instructions > General to the position in the 
current path at which the T branch is to commence. 


Fig. 7.6 shows a T branch. The parallel connection of #Fan1.works and #Fan2.works 
is followed by the branch in which a series connection of a NOT contact and an NO 
contact leads to a further coil. 


Series and parallel contact connections can be programmed following aT branch. A 
further T branch can also be opened within a T branch. However, you cannot enter 
logic operations which lead from the left-hand power rail to a T branch. 


v Network 5: Display when only one fan or no fan is running 


#Fant.works #Fan1 works #Display.onefan 


reo 


#Fan2.works 


“Clock 2 HZ #Display.nofen 


not -K——]{_ -’— }— 


Fig. 7.6 Example of a T branch (open parallel branch) and the NOT contact 


288 


7.2 Programming binary logic operations with LAD 


7.2.4 Negating result of logic operation 


The NOT contact negates the result of the logic operation (the “current flow”). 


To program a NOT contact, drag it with the mouse from the program elements 
catalog under Basic instructions > Bit logic operation to the working area. 


You can position the NOT contact like a standard contact in a branch which com- 
mences on the left-hand power rail. Positioning following aT branch is also permis- 
sible. Positioning of the NOT contact is not permissible in a parallel branch which 
commences in the middle of the current path. The NOT contact can also be used to 
negate the result of the logic operation (the “current flow”) at box inputs and out- 
puts. 


In Fig. 7.6 the parallel connection of #Fan1.works and #Fan2.works is negated. The 
resulting logic operation is: Not #Fan1.works AND not #Fan2.works. If no fan is 
working, the #Display.nofan tag flashes at 2 Hz. 


7.2.5 Edge evaluation of a binary tag 


An edge evaluation detects the change in a binary signal. 


To program an edge evaluation, drag the P or N contact with the mouse from the 
program elements catalog under Basic instructions > Bit logic operation to the work- 
ing area. 


The edge contact has the signal state “1” for one processing cycle if the signal state 
of the binary tags positioned above it changes from “0” to “1” (P contact, rising 
edge) or from “1” to “0” (N contact, falling edge). It responds like a “passing con- 
tact”. This “pulse” is linked to the result of the logic operation present prior to the 
contact. 


The edge trigger flag is present underneath the edge contact. This is a flag or data 
bit which saves the signal state of the binary tag. The signal edge is recognized by 
comparing the signal states of binary tags and edge trigger flags (see also Chapter 
12.2.5 “Edge evaluation” on page 472). 


The example in Fig. 7.7 shows an application of edge evaluation. Let us assume that 
an alarm has “arrived”, i.e. the alarm signal's state changes from “0” to “1”. Signal 


v Network 6:  Setalarm memory with signal edge 


#Alarm_memory 


#Alarm_bit SR "Clock 0,5 HZ #Alarm_lamp 
— 9——4 /—_ }— 
#Alarm_bit_ 


edge_memory 


#Acknowledge 


-——1 


Fig. 7.7 Example of an edge evaluation of a binary tag 
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state “1” is then present after the P contact for one program cycle. The 
#Alarm_memory tag is set by this, and the #Alarm_lamp tag flashes at 0.5 Hz. The 
alarm memory can be reset using an #Acknowledge button. The alarm memory re- 
mains reset if #Acknowledge has the signal state “O” again and #Alarm_bit is still 
present. #Alarm_memory is only set again by a further positive edge of #Alarm_bit 
(if #Acknowledge then no longer has signal state “1”). 


7.2.6 Comparison contacts 


A comparison contact compares two digital values and outputs a binary signal. A 
comparison which is correct is equivalent to a closed contact (“current” is flowing 
through the comparison contact). The contact is open if the comparison is incor- 
rect. The comparison function is described in Chapter 13.3 “Comparison functions” 
on page 518. 


To program a comparison function, drag it with the 
mouse from the program elements catalog under 
Basic instructions > Comparator operations to the 
working area. You position the comparison contact 
like a standard contact in the current path. You can 
then use drop-down lists to set the comparison 
mode and data type (Fig. 7.8). 


Fig. 7.9 shows two comparison contacts. If the #Mea- 
surement_temperature tag is above a lower limit and 
below an upper limit (series connection), the coil is 
activated and the #Measurement_in_range tag is set. 


Fig. 7.8 Drop-down lists for 
setting the comparison mode 


and data type 
v Network 7: Measured value in range (without hysteresis) 
#Measurement_ #Measurement_ Bibscwement 
temperature temperature i range 
>= <= 
Int | | Int { } 
#Lower_limit #Upper_limit 


Fig. 7.9 Example of comparison contacts 


7.3. Programming memory functions with LAD 


Coils control binary tags such as outputs or bit memories. Coils are available with 
an additional inscription and a special functionality such as coils with timer or 
counter functions (Fig. 7.10). Further coils such as those for jumps or the opening 
of a data block are described in Chapter 14 “Program flow control” on page 560. 
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Simple coil Set coil Reset coil 


Binary tag Binary tag Binary tag 
——{}—— 5} 4 4x} 


Coil with timer response 


xx= SP _ Start pulse timer 


SIMATIC timer = che arenas timer 
) tart on-delay timer 
( ae SS __ Start retentive on-delay timer 
Time value SF Start off-delay timer 


Coil with counter response 


SIMATIC counter SIMATIC counter é a 
( ) f ) XX = U ount up 
sc o CD Count down 
Count value 


Fig. 7.10 Overview of the coils described in this chapter 


7.3.1 Simple coil, assignment 


A simple coil directly assigns the current flow to the tag present on the coil: The tag 
is set to signal state “1” when current flows into the coil, and is reset to signal state 
“0” when current no longer flows. 


To program a simple coil, drag it with the mouse from the program elements cata- 
log under Basic instructions > Bit logic operation to the working area. Gray boxes in- 
dicate the permissible positioning, a green box identifies the position at which the 
coil will be inserted if you release the mouse button. 


The simple coil requires a preceding logic operation; it cannot be connected directly 
to the left-hand power rail. A coil can be positioned at the end of a current path, or 
in the middle. This also applies to a T branch. Positioning in a “closed” parallel 
branch is not permissible. 


v Network 8: Display with several flashing frequencies 


#Display. 


#Fan1.works #Fan2.works #Display.nofan “Clock 2 HZ Console 


#Fant.works #Fan2.works #Display.onefan “Clock 0,5 HZ #Display. 
eH Console2 


#Fan1.works #Fan2.works 


#Fan1.works #Fan2.works #Display.twofans 


HK ——S #——4 


Fig. 7.11 Example of arrangement for a simple coil 
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Simple coils can be connected in series or - at the end of a current path - in parallel. 
Simple coils do not change the result of the logic operation (the “current flow”). 


Fig. 7.11 shows the possible arrangements for a simple coil. In the current path, the 
#Display.nofan, #Display.onefan and #Display.twofans tags are controlled by simple 
coils. Two coils are connected in parallel at the end of the current path, and respond 
in identical manners. 


7.3.2 Set and reset coils 


A set or reset coil is used to assign signal state “1” or “O” to a binary tag in the case 
of a result of logic operation “1”. A result of logic operation “0” has no effect. 


To program the corresponding coil, drag it with the mouse from the program ele- 
ments catalog under Basic instructions > Bit logic operation to the working area. Gray 
boxes indicate the permissible positioning, a green box identifies the position at 
which the coil will be inserted if you release the mouse button. 


Set and reset coils require a preceding logic operation and terminate a current 
path. The reset coil can also be used to reset a SIMATIC timer or -counter function. 


In Fig. 7.12, #Fan1.start with signal state “1” sets the #Fan1.drive tag. With signal 
state “1” at #Fan1.stop, #Fan1.drive is reset. As a result of positioning of the reset 
coil after the set coil, the memory response is “reset dominant”: If both contacts 
have signal state “1”, #Fan1.drive is reset or remains reset. 


v Network 9: Control fan with S$ and R coils 


#Fant1.enable #Fant start #Fant drive 


ro =s-— 


#Fant.stop #Fant.drive 


|S? 


Fig. 7.12 Example of set and reset coils 


7.3.3 Retentive response due to latching 


The memory function in a circuit diagram is usually realized through latching of 
the output to be triggered. This realization can also be integrated into the ladder 
diagram. However, compared to the memory box, it has the disadvantage that the 
memory function is not recognized immediately. The latching principle is simple: 
The binary tag triggered by the coil is scanned, and this scan (the “coil contact”) is 
connected in parallel to the set condition. 


Fig. 7.13 shows both types of memory function through latching, namely set dom- 
inant and reset dominant. Network 10: If #Fan2.start closes, #Fan2.drive has signal 
state “1” and closes the contact parallel to #Fan2.start. If #Fan2.start then opens 
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v Network 10: Save function through latching (1) 


#Fan2.start #Fan2.stop #Fan2.drive 
-— 
#Fan2.drive 
v Network 11: Save function through latching (2) 
#Fan3.start #Fan3.drive 
) ee) 


#Fan3.drive #Fan3.stop 


Fig. 7.13 Retentive response due to latching 


again, #Fan2.drive remains switched on. #Fan2.drive is switched off if #Fan2.stop 
opens. If signal state “1” is present at both #Fan2.start and #Fan2.stop, no current 
flows into the coil (reset dominant). This situation looks different in network 11: If 
signal state “1” is present at both #Fan3.start and #Fan3.stop, current flows into the 
coil (set dominant). 


7.3.4 Coils with time response 


A coil with time response is a single element of a SIMATIC timer function. The timer 
function is usually applied as a box which contains all elements. The coil with time 
response corresponds to the S input of the time box. Attention must be paid to the 
sequence in the program when using the single elements. The time response of the 
coils is described in Chapter 12.3 “SIMATIC timer functions” on page 477. 


To program the corresponding coil, drag it with the mouse from the program 
elements catalog under Basic instructions > Timer operations to the working area. 


A coil with time response requires a preceding logic operation and terminates a 
current path. It can be connected parallel to all other coils. Positioning at the end of 
a T branch is also possible. 


The time tag is positioned above the coil with a time response. This is an operand 
from the range of SIMATIC timers (T). The time value is specified in the data format 
SSTIME underneath the coil. 


In Fig. 7.14, the timer “Fan4.delay” is started by the positive edge of #Fan4.start. Fol- 
lowing expiry of the duration (5 s in the example), the fan #Fan4.drive is switched 
on. If #Fan4.start has the signal state “O” prior to expiry of the duration, the fan is 
not even switched on. 
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v Network 12:  Switch-on with delay 


#Fan4 start “Fan4.delay” 


so} 


S5T#5S 


“Fan4.delay” #Fan4.drive 


es Oe 


Fig. 7.14 Example of a coil with time response 


7.3.5 Coils with counter response 


A coil with counter response is a single element of a SIMATIC counter function. The 
counter function is usually applied as a box which contains all elements. The SC coil 
corresponds to the S input of the counter box, the CU coil to the CU input and the 
CD coil to the CD input. Attention must be paid to the sequence in the program 
when using the single elements. The response of these coils is described in Chapter 
12.5 “SIMATIC counter functions” on page 495. 


To program the corresponding coil, drag it with the mouse from the program 
elements catalog under Basic instructions > Counter operations to the working area. 


A current path is terminated by a coil with counter response. It can be connected 
parallel to all other coils. Positioning at the end of a T branch is also possible. 


The counter tag is positioned above the coil with a counter response. This is an 
operand from the range of SIMATIC counters (C). The counter value in data format 
WORD is specified underneath the SC coil, where the numerical range extends from 
W#16#0000 to W#16#0999 or from C#000 to C#999. 


Fig. 7.15 counts the switch-on processes of #Fan1.start with the SIMATIC counter 
“Fan1.number”. The #Acknowledge signal resets the counter to 0. 


v Network 13: Count switch-on processes 


#Enabling #Fant start “Fan1.number™ 


Rt Ye FSAI 


#Acknowledge “Fani.number 
Re ro 
c#0 


Fig. 7.15 Example of coils with counter response 


294 


7.4 Programming Q boxes with LAD 


7.4 Programming Q boxes with LAD 


Q boxes have a binary output named “Q” which can be linked further. Q boxes are 
used to represent memory functions, edge evaluations, and timer and counter 


functions (Fig. 7.16). 


Boxes with Q output 


SR memory box Binary tag RS memory box Binary tag 
SR RS 
—s oo— —R oy— 
iil —eB 
Evaluation with P_TRIG Evaluation with N_TRIG 
rising edge falling edge 
wed — CLK oy iti —iaik Q— 
Edge trigger flag Edge trigger flag 
SIMATIC timer functions IEC timer functions 
S PULSE TP, TON and TOF 
ae SIMATIC timer #Local instance "Single instance" 
s_ODTS S_PULSE ae noe 
S$ _OFEDT —s Q— ins 
—Iv Bl — —_ 7_ EE 
— a — —?PT eT— —pPT eT — 


SIMATIC counter functions 


S_CUD 

S_CU SIMATIC counter 

S_CD 

- S CUD 

—cuU Q — 
—cD ——— 
— Gee h:— 
—h 


lhl 


IEC counter functions 
CTUD, CTU and CTD 


#Local instance 


CTUD 
Int 
—iGl oul— 
— iG QD — 
ome | (CY el 
—LD 
— Pv 


"Single instance” 


CTUD 
Int 
— CU ‘oul— 
—iGb QD — 
hh Vv 
— LD 
— Ev 


Fig. 7.16 Overview of Q boxes available with LAD 


With Q boxes, the first binary input (and in certain cases the associated parameter) 
must be connected; connection of the other inputs and outputs is optional. The bi- 
nary inputs of Q boxes cannot be directly connected to the left-hand power rail. 
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When using Q boxes as program elements, you can: 


> Program one single box per network, either within the current path or as its 
termination 


> Arrange boxes in series by connecting the Q output of one box to a binary input 
of the following box 


> Position boxes following T branches and in branches which commence on the 
left-hand power rail 


7.4.1 Memory boxes 


There are two versions of the memory function as box: as SR box (reset dominant) 
and as RS box (set dominant). With reset dominant, the memory function is reset 
or remains reset if both inputs have signal state “1”. With set dominant, the mem- 
ory function is set or remains set in such a case. The response of the memory box 
is described in Chapter 12.2 “Memory functions” on page 468. 


For programming, drag the SR or RS symbol with the mouse from the program 
elements catalog under Basic instructions > Bit logic operation to the working area. 


Fig. 7.17 shows a binary scaler: Each positive edge of the #Bin_input tag changes the 
signal status of #Bin_output. Thus half the input frequency is present at the output. 


v Network 14: Binary scaler (1) 
#Bin_output 
#Bin_input #Bin_memory SR 


-——__+/+-—— Q $$ 


#Bin_input #Bin_memory 


/——4 -— 


v Network 15: Binary scaler (2) 


#Bin_memory 
#Bin_input #Bin_output SR 


-#—s  —$—$— 


#Bin_input 


#Bin_output 


Fig. 7.17 Example of binary scaler 


7.4.2 Edge evaluation of current flow 


The edge evaluation with Q boxes registers a change in the current flow prior to the 
box. If the signal state changes from “0” to “1” (rising edge) at the CLK input of the 
P_TRIG box, signal state “1” is present at the Q output for the duration of one pro- 
gram cycle. If the result of the logic operation changes from “1” to “O” (falling edge) 
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at the CLK input of the N_TRIG box, the Q output is activated for the duration of one 
program cycle. The response of the boxes for edge evaluation is described in Chap- 
ter 12.2 “Memory functions” on page 468. 


For programming, drag the P_TRIG or N_TRIG symbol with the mouse from the 
program elements catalog under Basic instructions > Bit logic operation to the work- 
ing area. 


The edge boxes require a preceding logic operation and may only be positioned 
within a current path. 


In Fig. 7.18, 4#Measurement.Memory is set if #Measurement_temperature exceeds an 
upper limit. In turn, the #Measurement.Memory tag sets the #Measurement.Message 
memory. Setting is carried out in both cases by a pulse with positive edge so that 
acknowledgment is also possible with a set signal present. Acknowledgment is also 
carried out by a pulse so that, with an acknowledgment signal present, the measured 
value memory and the message memory are set if the upper limit is exceeded again. 


v Network 16: Measured-value alarm with memory 


#Measurement. #Measurement. 
#Measurement_ Memory Message 
temperature 
P_TRIG SR P_TRIG SR 
m clk Qq—s Q—ck Qa—s q— 
#Upper_limit #Measurement. #Measurement. 
Edget Edge2 
#Measurement. 
Ack_memory 
P 


#Measurement. 
Edge3 


#Measurement. 
Ack_message 


2 


#Measurement. 
Edge4 


Fig. 7.18 Example of edge evaluations of current flow 


7.4.3. SIMATIC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
The box of a SIMATIC timer function contains all statements required for the 
sequence. A detailed description of the SIMATIC timer functions is provided in 
Chapter 12.3 “SIMATIC timer functions” on page 477. 


For programming, drag the corresponding symbol S_ PULSE, S PEXT, S_ ODT, 
S_ODTS or S_OFFDT with the mouse from the program elements catalog under 
Basic instructions > Timer operations to the working area. You can subsequently 
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v Network 17: Fan switch-on and offdelay 


“FanS.on-delay” “Fan5.Offdelay” 
#FanS.start S_ODT S_PEXT #Fan5S.drive 
-K—s Qf q———{ }— 
S5T#3S —1V Bi —... S5T#58S —1V Bi —... 
oR BCD —... = R BCD —... 


Fig. 7.19 Example of SIMATIC timer functions in the ladder logic 


change the function using a drop-down list which you can open using the small yel- 
low triangle when the box is selected. 


The start input S and the time value TV must be connected; connection of the other 
box inputs and outputs is optional. 


Fig. 7.19 shows a switch-on and switch-off delay. The timer function “Fan5.on-de- 
lay” is started by #Fan5.start. The Q output has signal state “1” after 3 s, which starts 
the timer function “Fan5.off-delay”. At the same time, the #Fan5.drive tag is started 
by the Q output of the box. The Q output still has signal state “1” for 5 s after 
#Fan5.start has signal state “O”. 


7.4.4 SIMATIC counter functions 


Counter functions are used to implement counting tasks in the user program. The 
box of a SIMATIC counter function contains all statements required for the 
sequence. A detailed description of the SIMATIC counter functions is provided in 
Chapter 12.5 “SIMATIC counter functions” on page 495. 


For programming, drag the corresponding symbol (S_CUD, S CU orS_CD) with the 
mouse from the program elements catalog under Basic instructions > Counter oper- 
ations to the working area. You can subsequently change the function using a drop- 
down list which you can open using the small yellow triangle when the box is se- 
lected. 


v Network 18: Workpiece counter 


#Workpart_ “Piece_counter" #Quantity_ 
identified s_cD reached 
-#——cd Q—— nor h—_____________{ }— 
v—... 
#Quantity_set CV_BCD —... 
#—s 
C#120— PV 


Fig. 7.20 Example of SIMATIC counter functions in the ladder logic 
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At least one of the counter inputs (CU or CD) must be connected; connection of the 
other box inputs and outputs is optional. 


Fig. 7.20 shows a down counter. The name of the SIMATIC counter used is 
positioned above the counter box. #Quantity_set sets the counter to the count value 
W#16#0120. The count value is reduced by 1 with each pulse from #Workpiece_iden- 
tified. Once zero has been reached, #Quantity_reached is set. 


7.4.5 IEC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
With a CPU 400, an IEC timer function is a system function block (SFB) in the oper- 
ating system. A detailed description of the IEC timer functions is provided in Chap- 
ter 12.4 “IEC timer functions” on page 491. 


For programming, drag the corresponding symbol (TP, TON or TOF) with the 
mouse from the program elements catalog under Basic instructions > Timer opera- 
tions to the working area. When positioning, you select either as single instance or 
- possible in a function block — as local instance. The instance data block generated 
automatically when selecting as a single instance is saved in the project tree under 
Program blocks > System blocks > Program resources. 


You can subsequently change the timer function using a drop-down list which you 
can open using the small yellow triangle when the box is selected. 


With the IEC timer functions, the IN input must have a preceding logic operation 
and a duration must be connected to the PT input. The Q output can be supplied 
with a coil, but cannot be linked further. You can also directly access the output 
parameters using the instance data, for example with “DB name”.Q or 
“DB _name’”.ET for a single instance. 


Fig. 7.21 shows the IEC timer function #MessageDelay, which saves its data as local 
instance in the instance data block of the calling function block. If the #Measure- 
ment_too_high tag has a signal state “1” for longer than 10 s, 4Message_too_high is 
set. 


v Network 19: Alarm delay 
#MessageDelay 


#Measurement_ TON #Message_too_ 
too_high Time high 
-— IN Q—_—_— { } 
T#10S — PT ET—... 


Fig. 7.21 Example of IEC timer functions 
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7.4.6 IEC counter functions 


Acounter function implements counting processes in the user program. With a CPU 
400, an IEC counter function is a system function block (SFB) in the operating sys- 
tem. A detailed description of the IEC counter functions is provided in Chapter 12.6 
“TEC counter functions” on page 502. 


For programming, drag the corresponding symbol (CTUD, CTU or CTD) with the 
mouse from the program elements catalog under Basic instructions > Counter oper- 
ations to the working area. When positioning, you select either as single instance or 
- possible in a function block — as local instance. The instance data block generated 
automatically when selecting as a single instance is saved in the project tree under 
Program blocks > System blocks > Program resources. 


You can subsequently change the timer function using a drop-down list which you 
can open using the small yellow triangle when the box is selected. 


With the IEC counter functions, at least one counter input (CU or CD) must have a 
preceding logic operation. Connection of the other box inputs and outputs is 
optional. A coil can be positioned at the top output QU, but not a further logic oper- 
ation. The QD output cannot be supplied, but can be scanned indirectly via the 
corresponding component QD of the counter structure. For the QU output, this 
would be the component QU. 


One can also directly access the output parameters using the instance data, for ex- 
ample with “DB_name”.QD for a single instance. 


Fig. 7.22 shows the IEC counter function #LockCounter, which is called as a local 
instance. It has saved its data in the instance data block of the calling function block. 
A component of the counter can be addressed globally with the name of the 
instance and the component name, for example #LockCounter.CV. The example 
shows the passages through a lock, either forward or backward. 


v Network 20: Single lock counter 


#LockCounter 


cTUD 
#Light_barrier_1 #Light_barrier_2 Int 
re ——m — wu Qu ————— 
#Light_barrier_2_ QD +... 
edge_memory o—_ 


#Light_barrier_2 #Light_barrier_1 


exG4oe————m—o 
#Light_barrier_1_ 
edge_memory 


#Acknowledge 


| $$ 


-=LD 


Fig. 7.22 Example of IEC counter functions 
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7.5 Programming EN/ENO boxes with LAD 


EN/ENO boxes have an enable input EN and an enable output ENO. The enable input 
can be used to control processing of the box. If an error occurs while the box is 
being processed, this is displayed at the enable output. Fig. 7.23 provides an over- 
view of the “basic” functions implemented with EN/ENO boxes. 


The parameters of the EN/ENO boxes must all be connected. The enable input EN 
and the enable output ENO are not parameters of the box function. They are used 
for processing boxes and are added to the box function by the program editor. 


An EN/ENO box can be positioned on its own in a network, with or without connec- 
tion of the EN input or the ENO output. The ENO output can be connected to the EN 
input of the following box. By means of a contact at the beginning of this “main cur- 
rent path”, it is possible to switch processing of the complete current path on and 
off. The signal state of the ENO output of the last box indicates by means of a “1” 
that the complete sequence has been processed without errors. 


The ENO output of a box can be connected in parallel with the ENO output of a dif- 
ferent box if the boxes are present in separate current paths which commence on 
the left-hand power rail. “Current” then flows in the subsequent path if one of the 
two boxes has completed the processing without errors. 


If an EN/ENO box is positioned in a T branch, its ENO output can no longer be 
returned to the path at which the T branch commences. 


A detailed description of EN and ENO and how one can use the EN/ENO mechanism 
with self-created blocks can be found in Chapter 7.6.2 “EN/ENO mechanism with 
LAD” on page 309. The block calls in the ladder diagram, which are also shown as 
EN/ENO boxes, are described in Chapter 14.4 “Calling of code blocks” on page 576. 


Boxes with EN input and ENO output 


Transfer functions Arithmetic functions Math functions 
MOVE ADD, SUB, MUL, DIV, MOD NEG, ABS, SQR, SQRT, LN, EXP, 
SIN, COS, TAN, ASIN, ACOS, ATAN 
MOVE ADD 
—EN  ENO— Boletos EXP 
— IN ouUT1 — — EN ENO — Real 
aN OUT—— TEN ENO-—— 
The — IN OUT — 
Conversion functions Shift functions Logical operations 
CONVERT, ROUND, CEIL, SHL, SHR, ROL, ROR AND, OR, XOR, INV 
FLOOR, TRUNC 
SHR XOR 
CONV Data type Data type 
DType to DIype — EN ENO —— — EN ENO —— 
— EN ENO — — IN OUT — —IN1 OUT — 
— IN OUT1 — —N —IN2 


Fig. 7.23 Overview of boxes with enable input EN and enable output ENO 
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7.5.1 Transfer function, MOVE 


The transfer function MOVE transfers the value of one tag to another. 


For programming, drag the symbol of the MOVE function with the mouse from the 
program elements catalog under Basic instructions > Move operations to the work- 
ing area. 


A detailed description of the transfer function is provided in Chapter 13.2 “Transfer 
functions” on page 508. 


In Fig. 7.24, the #Messages tag is transferred from the data block “Data.LAD” to the 
“Message_bits” tag in the bit memory address area. 


v Network 21: Transfer variable value 


MOVE 
EN EN 


"Data.LAD™. OUT! — “Message_bits* 
Messages — |N 


Fig. 7.24 Example of a transfer function in the ladder logic 


7.5.2 Arithmetic functions 


An arithmetic function for numerical values implements the basic arithmetical 
operations with the data formats INT, DINT, and REAL in the user program. A detailed 
description of these arithmetic functions is provided in Chapter 13.4 “Arithmetic 
functions” on page 521. 


For programming, drag one of the arithmetic functions (ADD, SUB, MUL, DIV, 
or MOD) with the mouse from the program elements catalog under Basic instruc- 
tions > Math functions to the working area. You can set the function (ADD, SUB, MUL, 


v Network 22: Measured value in range with hysteresis 


#Measurement_ 
#Measurement_ too_high 
temperature 
SR 


>= | 
Int 5 Q 


#Upper_limit 


SUB #Measurement_ 
temperature 


<= 
EN ENO ———____- Int | RI 


#Upper_limit — IN1 OUT — #temp_int #temp_int 
#Hysteresis — IN2 7 


Fig. 7.25 Example of an arithmetic function in the ladder logic 
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DIV, or MOD) and the data type (INT, DINT, or REAL) using drop-down lists which 
you can open using the small yellow triangle when the box is selected. The data type 
is also automatically set when the first actual value is created. 


In Fig. 7.25, the upper limit of a measured value is monitored. A hysteresis is intro- 
duced to ensure that the #Measurement_too_high message does not “pulsate” when 
the measured value changes rapidly around the upper limit. The message #Mea- 
surement_too_high is only canceled when the measured value has dropped again 
below the upper limit by the magnitude of the hysteresis. 


7.5.3 Math functions 


The mathematical functions comprise, for example, trigonometric functions, expo- 
nential functions, and logarithmic functions with tags in data format REAL. A de- 
tailed description of these math functions is provided in Chapter 13.5 “Math func- 
tions” on page 527. 


For programming, drag one of the mathematical functions (NEG, ABS, SQR, SQRT, 
LN, EXP, SIN, COS, TAN, ASIN, ACOS, or ATAN) with the mouse from the program 
elements catalog under Basic instructions > Math functions to the working area. You 
can set the function (NEG, ABS, SQR, SORT, LN, EXP, SIN, COS, TAN, ASIN, ACOS, or 
ATAN) using drop-down lists which you can open using the small yellow triangle 
when the box is selected. The data type is permanently set to REAL. 


Fig. 7.26 shows the calculation of the reactive power according to the equation 
#Reactive_power = #Voltage x #Current x sin(#phi). 


v Network 23: Calculate reactive power (1) 


MUL 
Real 


EN ENO 


#Voltage — INI OUT — #temp_realt 
Current — IN2 


v Network 24: Calculate reactive power (2) 
SIN 
Real 
EN EO ———— 
#phi— IN OUT — #temp_real2 


v Network 25: Calculate reactive power (3) 


MUL 
Real 


EN EN 


#temp_reall — IN1 OUT — #Reactive_power 
#temp_real2 — IN2 


Fig. 7.26 Example of math functions in the ladder logic 
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7.5.4 Conversion functions 


The conversion functions convert the data formats of tags. A detailed description of 
the conversion functions is provided in Chapter 13.6 “Conversion functions” on 
page 531. 


Table 7.1 shows the data type conversions possible with LAD. 


For programming, drag one of the conversion functions (CONVERT, ROUND, CEIL, 
FLOOR, or TRUNC) with the mouse from the program elements catalog under Basic 
instructions > Conversion operations to the working area. You can set the function 
and data types using drop-down lists which you can open using the small yellow tri- 
angle when the box is selected. If the first actual value created has a permissible da- 
ta type, the data type is also set automatically. 


The conversion function T_CONV for data type conversion of date/time can be found 
in the program elements catalog under Extended instructions > Date and time_of_day. 


Table 7.1 Data type conversion with LAD 


le o/|2 S «/|Z/ela 
BOOL 
BYTE IX IX 10 
WORD IX 10 ie) 10 
DWORD 10 10 10 
INT 10 Cc Ss Cc 
DINT Ke) Cc ite) Ss Cc 
REAL R Ss 
TIME ie) 10 T 
SSTIME 10 T 
DT T1) T T 
TOD ie) 
DATE 10 
CHAR 10 
STRING Ss Ss Ss 
BCD16 Cc 
BCD32 C 
Data type conversion is possible: IX Implicitly and independent of attribute /EC check 
10 Implicitly with deactivated attribute IEC check 
Cc Explicitly with CONV 
R_— Explicitly with ROUND, CEIL, FLOOR, and TRUNC 
T Explicitly with T_CONV, 1) Conversion to day of week 
S Explicitly with S_ CONV 


Additionally: ATH, HTA, SCALE, UNSCALE 


304 


7.5 Programming EN/ENO boxes with LAD 


v Network 26: Measured-value display BCD (1) 


CONV 
Int to Dint 


EN 12 
OUT — #temp_dint 


#Messurement_ 
temperature — IN 


Vv Network 27: Measured-value display BCD (2) 


CONV 
Dint to Bcd32 
EN ENO —_—_—_———————e“ cw“ 


#temp_dint — IN #Measurement_ 
OUT — display 


Fig. 7.27 Example of the conversion functions in the ladder logic 


The conversion function S_CONV for data type conversion of character strings can be 
found in the program elements catalog under Extended instructions > String + Char. 


Fig. 7.27 shows an example of the conversion functions. A measured value present 
in data format INT is first expanded to the data format DINT and then converted in- 
to the BCD format. 


7.5.5 Shift functions 


The shift functions shift the content of tags bit-by-bit to the left or right. A detailed 
description of the shift functions is provided in Chapter 13.7 “Shift functions” on 
page 544. 


For programming, drag one of the shift functions (SHL, SHR, ROL, or ROR) with the 
mouse from the program elements catalog under Basic instructions > Shift and 
rotate to the working area. You can set the function (SHL, SHR, ROL, and ROR) and 
data types using drop-down lists, which you can open using the small yellow trian- 
gle when the box is selected. The data type is also automatically set when the first 
actual value is created. 


In Fig. 7.28, the respective three decades of two numbers present in BCD format of 
a SIMATIC counter are joined without gaps. Using the shift function SHL - set to 


v Network 28: Counted-value display BCD 


SHL OR 
DWord DWord 
EN EL ENO ——4 
#Quantity_high —aIN OUT — #temp_dword #temp_dword — IN1 OUT — #Quantity_display 
W#16#000C —N #Quantity_low —aIN2 


Fig. 7.28 Example of the shift functions in the ladder logic 
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data type DWORD! - the #Quantity_high tag is shifted to the left by 12 bits, corre- 
sponding to three decades. A small square on the input parameter IN indicates that 
the data type of the applied tag (WORD in the example) does not agree with the data 
type of the function (DWORD in the example) and has to be converted implicitly. The 
bottom three decades (the #Quantity_low tag) are subsequently added by a double- 
word logic operation according to OR and output to the #Quantity_display tag. 


7.5.6 Word logic operations 


The word logic operations link each bit of two tags according to an AND, OR, or 
exclusive-OR function. A detailed description of the word logic operations is provid- 
ed in Chapter 13.8.1 “Word logic operations” on page 549. 


For programming, drag one of the word logic operations (AND, OR, XOR, INV) with 
the mouse from the program elements catalog under Basic instructions > Word logic 
operations to the working area. You can set the function (AND, OR and XOR with 
AND, OR and XOR, INV is fixed) and the data type (WORD and DWORD with AND, OR 
and XOR, INT and DINT with INV) via drop-down lists which you can open using the 
small yellow triangle when the box is selected. The data type is also automatically 
set when the first actual value is created. 


Fig. 7.29 shows how you can program 32 edge evaluations simultaneously for ris- 
ing and falling edges. The message bits are collected in a doubleword Messages, 
which is present in data block “Data.LAD”. The edge trigger flags Messages _EM are 


Vv Network 29: Example of digital edge evaluation (1) 


XOR AND 
DWord DWord 
EN EN Oe FN ENO ——4 
“Data.LAD*. #Messages_ #Messages_ “Data-LAD". 
Messages — IN1 OUT — changed changed — IN1 OUT — Messages_pos 
“Data.LAD*. “Data-LAD*. 
Messages_EM— IN2 Messages — IN2 


v Network 30:  Exemple of digital edge evaluation (2) 


XOR AND 
DWord DWord 
EN ENO —_—_—_—_—_— EN ENO ——4 
“Data.LAD*. #Messages_ #Messages_ “Data-LAD". 
Messages — |N1 OUT — negated changed — IN1 OUT — Messages_neg 
DW 164FFFF_ #Messages_ 
FFFF — IN2 negated — IN2 


v Network 31: Example of digital edge evaluation (3) 


MOVE 
EN _——————EEEEEEEE | 
“Data-LAD". “Data.LAD*. 
Messages — |N OUTI — Messages_EM 


Fig. 7.29 Example of word logic operations in the ladder logic 
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also present in this data block. If the two doublewords are linked by an XOR logic 
operation, the result is a doubleword in which each set bit represents a different as- 
signment of Messages and Messages_EM, in other words: the associated message bit 
has changed. In order to obtain the positive signal edges, the changes are linked to 
the messages by an AND logic operation. The bit is set for arising signal edge wher- 
ever the message and the change each have a “1”. This corresponds to the pulse flag 
of the edge evaluation. If you do the same with the negated message bits - the mes- 
sage bits with signal state “O” are now “1” - you obtain the pulse flags for a falling 
edge. At the end it is only necessary for the edge trigger flags to track the messages 
(last network in Fig. 7.29). 


7.6 Controlling the program flow with LAD 


You can influence processing of the user program by means of the program flow 
control functions. The available functions are shown in Fig. 7.30. 


7.6.1 Working with status bits in the ladder logic 


Scanning status bits 


Status bits provide information on the result of an arithmetic function and on any 
errors, for example exceeding a numerical range. Chapter 14.1.5 “Evaluating the 
status bits” on page 566 describes how you can use contacts to scan the signal state 
of the status bits. 


For programming, drag the NO or NC contact labeled Status with the mouse from 
the program elements catalog under Basic instructions > Further instructions to the 
working area. You can set the status bit to be scanned (OV, OS, UO, BIE, ==0, >=0, 
<=0, >0, <0, and <>0) via a drop-down list which you can open using the small 
yellow triangle when the contact is selected. 


Example: In Fig. 7.31, a floating-point number is checked for validity. To do this, the 
tag is compared with any floating-point constant. The type of comparison does not 
play arole here. If the floating-point number is invalid, the comparison is incorrect in 
all cases and the status bit OV (overflow) is set. Thus if the comparison is incorrect and 
the overflow bit is set, the intermediate memory #Floating_point_number_invalid is 
set and the JMP (jump) to the Error label is carried out. 


Save binary result 


With the SAVE coil you can save the result of logic operation RLO in the binary result 
BIE. A detailed function description of the SAVE coil is provided in Chapter 14.1.4 
“Controlling the binary result” on page 565. 


For programming, drag the SAVE coil with the mouse from the program elements 
catalog under Basic instructions > Further instructions to the working area and, if ap- 
plicable, set the SAVE function via a drop-down list which you can open using the 
small yellow triangle when the contact is selected. 
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Functions for program flow control 


Scan status bit Save binary result 
Status bit Status bit 
Jump functions Block end function 
Target Target RLO 
——_{ JMP | ——{smpn}—_| ——_( RET | 
Select data block Change block 
Data block Data block Logic block 
Block calls 
Calling a function (FC) Calling a function block (FB) 
DB_name 
FC_name FB_name 
— EN ENO — — EN ENO y— 
— aren pernins. — —perani? poramls)— 
— param_2 — param_2 
Master control relay 
Activate MCR area Open MCR zone Close MCR zone Deactivate MCR area 


Fig. 7.30 Overview of functions for program flow control in the ladder logic 


The SAVE coil requires a preceding logic operation and is present alone in a current 
path. A T branch must not be programmed in the network with a SAVE coil. Note 
that the SAVE coil does not terminate the logic operation, and therefore the logic 
operation can be continued in the following network. 


Vv Network 32: Check floating-point number 


#Floating_point_ 


#Floating_point, 
number St 


Ov number_invalid Error 
a / 4 or R$ tir 
Real 


1.0 


Fig. 7.31 Example of scanning a status bit with LAD 
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You can control the ENO output of the block with the SAVE coil if you call the coil 
in the last network of the block. In the example in Fig. 7.34 on page 312, the 
error messages are collected in the last network of the block: #Float- 
ing_point_number_invalid (error with “1”) and #Adder_error (error with “O”). The 
logic operation must not be fulfilled with an error; in this case signal state “O” is 
transferred by the SAVE coil to the ENO output. 


7.6.2. EN/ENO mechanism with LAD 


With LAD, all block calls and functions (statements) for which an error can occur 
have an enable input EN and an enable output ENO. 


The EN input and the ENO output are not block parameters and are not declared. 
They are statement sequences which the program editor generates in the program 
before and after a block or function call. They are not visible to the user. The EN in- 
put and the ENO output are both of data type BOOL. 


You can use the properties of EN and ENO to connect several boxes into a sequence, 
where the enable output ENO leads to the enable input EN of the next box. In this 
manner it is possible, for example, to “switch off” the complete sequence, or the 
rest of the sequence is no longer processed if a box signals an error. 


Controlling a processing sequence 


In the example in Fig. 7.32, neither of the boxes is processed if the #Enabling tag has 
signal state “O”. If an error occurs during processing of the ADD box, for example a 
numerical range is exceeded, the subsequent SQRT box is no longer processed. 


v Network 33: Control processing sequence 


ADD SQRT 
#Enabling Real Real 
-#———EN ENO —$—$_ <_< _ ny ENO—— 
#var_a—IN1 OUT — #temp_real #temp_real — IN OUT — #var_c 


#var_b — IN2 


Fig. 7.32 Example of series connection of ENO and EN with LAD 


Enable input EN 


You can control the calling of a block using the enable input EN. If EN has signal 
state “1” or is connected to the left-hand power rail, the called block is processed. If 
EN has signal state “O”, the called block is not processed. A jump is then made 
beyond the block call to the next following statement (function). 
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Enable output ENO 


You can scan the error status of the block using the enable output ENO. If ENO has 
signal state “1”, processing has been carried out correctly. With signal state “0”, the 
ENO output signals that the block was not called (EN was “0”) or that an error is 
present in the block (Fig. 7.33). 


Is EN connected? 
YES 


Block/function being processed 


Block/function being processed Block/function not 
being processed 
Has an error occurred? Has an error occurred? 


YES NO YES NO 
ENO output is ENO output is ENO output is ENO output is ENO output is 
set to “0” set to “1” set to “0” set to “0” set to “1” 


Fig. 7.33 Schematic diagram for setting of enable output ENO 


The ENO output has the signal state which the binary result BIE had in the block. 
With self-created blocks, you can control the assignment of the ENO output via the 
binary result in order, for example, to signal faulty processing in the block. 


Example: In Fig. 7.34 on page 312, in the first network the #Adder_error tag is set to 
signal state “O” in the event of an error in the “Adder.LAD” block, and a jump is made 
to the Error label. The jump label Error is present in the last network of the block. 
The binary result BIE, and thus also the ENO output of the current block, are set to 
signal state “O” here by means of the SAVE coil. 


7.6.3 Jump functions 


To program ajump function, drag ajump coil with the mouse from the program el- 
ements catalog under Basic instructions > Program control operations to the working 
area. You define the jump label (the jump destination) using the jump coil. To pro- 
gram the jump destination, use the mouse to drag the Label function to the start of 
the network with which processing of the program is to be continued from the pro- 
gram elements catalog under Basic instructions > Program control operations and 
write the label into the box. 


You can subsequently set the jump function (MP or JMPN) via a drop-down list 
which you can open using the small yellow triangle when the coil is selected. You 
can also directly connect the coil with the jump function JMP to the left-hand power 
rail. The jump is always carried out in this case (absolute jump). The jump function 
JMPN always requires a preceding logic operation. 
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The jump functions cannot be programmed in association with a T branch. Only 
one jump function is permissible per network. If you use the Master Control Relay 
(MCR), the jump destination must be located in the same MCR zone or in the same 
MCR area as the jump function. 


A detailed description of the jump functions is provided in Chapter 14.2 “Jump 
functions” on page 568. 


Fig. 7.31 on page 308 and Fig. 7.34 show examples of the jump functions. In the first 
example, ajump is carried out by means of aJMP coil to the Error label upon a result 
of logic operation “1”. In the second example, a jump is also carried out by means 
of aJPMN coil to the Error label upon a result of logic operation “0”. 


7.6.4 Block functions 


Block end function, RET coil 


To program the block end function, drag the RET coil with the mouse from the pro- 
gram elements catalog under Basic instructions > Program control operations to the 
working area. Above the RET coil, RLO (result of logic operation) indicates that the 
result of the logic operation present in front of the RET coil (the “current flow”) is 
assigned to the ENO output of the block which has been left. 


A detailed description of the RET coil is provided in Chapter 14.3.1 “Block end func- 
tion RET (LAD and FBD)” on page 575. 


The RET coil requires a preceding logic operation and must only terminate a cur- 
rent path on its own. 


In the second network in Fig. 7.34, the block with the RET coil is left if the “Adder” 
block does not signal an error. 


Open data block; OPN and OPNI coils 


To program the OPN or OPNI coil, drag it with the mouse from the program 
elements catalog under Basic instructions > Program control operations to the work- 
ing area. With OPN you open a data block via the DB register, with OPNI via the DI 
register. 


You can subsequently set the function (OPN or OPNI) via a drop-down list which you 
can open using the small yellow triangle when the coil is selected. 


The OPN or OPNI coil is present alone in a network without a preceding logic oper- 
ation. 


A detailed description of the OPN or OPNI coil is provided in Chapter 14.5.1 “Open- 
ing a data block” on page 583. 
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v Network 34: FC call and jump in event of fault 


"Adder.LAD" #Adder_error Error 
EN ENO———+{_ {J PN }}] 
“Data.LAD*. “Data-LAD". 
Quantity[1] — Number_1 Result — Adder_result 
“Data-LAD*. 
Quantity{[2] — Number_2 
“Data.LAD*. 


Quantity{3] — Number_3 


v Network 35: FB call as single instance and RET coil 
“DB_Totalizer.LAD* 
“Totalizer.LAD* RLO 
EN ENO —$— RET }-—] 
“Data.LAD". “Data-LAD*. 
Measurement[1]— Value? Sum — Totalizer_result 


“Data-LAD*. 
Measurement[2] — Value2 


“Data.LAD". 
Measurement[3] — Value3 


Vv Network 36: Signal fault vias ENO 
Error 


#Floating_point_ 
number_invalid #Adder_error 


P_ sive py 


» Network 37: Block end 


Fig. 7.34 Examples of functions for program flow control in the ladder logic 


Opening a data block using block parameters 


A block parameter with parameter type BLOCK_DB allows the transfer of a data 
block (or more precisely: a data block number) to the called block. You call this data 
block as a global data block in the called block with the OPN coil via the DB register. 


Calling of a data block transferred with BLOCK_DB is not possible via the DI register. 


Block change, CALL coil 


To program the CALL coil, drag it with the mouse from the program elements cata- 
log under Basic instructions > Further instructions to the working area. With CALL, 
you call a code block which must not have any block parameters. 


The CALL coil is present alone in a network. The CALL coil can be connected directly 
to the left-hand power rail — the block call then takes place without conditions, or it 
can follow a preceding logic operation. 
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A detailed description of the CALL coil is provided in Chapter 14.4.4 “Change to a 
block without block parameter” on page 581. 


Block call functions 


Calling of a block is represented by an EN/ENO box. With a function (FC), the block 
name is present quasi as a function name in the box; with a function block, the in- 
stance name (the name of the instance data block or the name of the local instance) 
is additionally present above the box. A detailed description of the block calls is pro- 
vided in Chapter 14.4 “Calling of code blocks” on page 576. 


To call a code block, use the mouse to drag the block which has already been pro- 
grammed from the project tree under Program blocks into the working area. Witha 
logic operation preceding the EN input you can structure the block call depending 
on conditions. 


The top network in Fig. 7.34 shows the call of a function (FC). The function name is 
present as the title in the call box. In the event of an error in the block (ENO is then 
“Q”), #Adder_error is set to “O” and a jump made to the network with the Error label. 
In the next network, the call of a function block is present as a single instance. The 
name of the function block is present as the title in the call box, the instance name 
- in this case the name of the instance data block - is present above the box. 


7.6.5 Master Control Relay (MCR) 


The Master Control Relay controls write operations to the user memory. A detailed 
description of the MCR functions is provided in Chapter 14.6 “Master control relay” 
on page 587. 


You use the MCRA and MCRD coils to define an MCR area. The two coils are each 
present alone in a network. 


You use the MCR< coil to open an MCR zone. The coil requires a preceding logic 
operation and terminates a current path. If “current” flows into the coil, the MCR 
dependency is switched off (“normal” processing); if no “current” flows into the 
coil, the MCR dependency is switched on. 


The MCR> coil closes an MCR zone and is present alone in a network. 

To program the corresponding MCR function, drag it with the mouse from the pro- 
gram elements catalog under Basic instructions > Further instructions to the working 
area. You can subsequently set the function (MCR<, MCR>, MCRA, or MCRD) via a 
drop-down list which you can open using the small yellow triangle when the coil is 


selected. 


Fig. 7.35 shows the networks required to switch the MCR dependency on and off. 
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v Network 38: Master Control Relay (1) Activate MCR dependency 


MCRA }—| 


v Network 39: Master Control Relay (2) Switch on MCR zone 


#*MCR-Zone_ 
switch-on" 


-——_———————_  ——er- +] 


v Network 40: Master Control Relay (3) Program in the MCR zone 


v Network 41: Master Control Relay (4) Switch off MCR zone 


McR> }—| 


v Network 42: Master Control Relay (5) Deactivate MCR dependency 


McRD }#— 


Fig. 7.35 MCR dependency and MCR zone in ladder logic 


If MCR dependency is switched on, the following system blocks influence the oper- 
ands in the I/O range, in the process image, and in the bit memory address area: 


> SET, SETI, and SETP set the parameterized operands to signal state “1” 
> RESET, RESETI, and RESETP reset the parameterized operands to signal state “O”. 


The system blocks can be found in the program elements catalog under Basic in- 
structions > Further instructions. A detailed description of these blocks is provided 
in Chapter 13.2.6 “Control memory area with MCR dependency” on page 515. 
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8 Function block diagram FBD 


8.1 Introduction 


This chapter describes programming with function block diagram (FBD); it uses 
examples to show how the program functions are represented in FBD. You can find 
a description of the individual functions, e.g. comparison functions, in Chapters 12 
“Basic functions” on page 461, 13 “Digital functions” on page 507, and 14 “Program 
flow control” on page 560. 


Use of the program and symbol editor, which generally applies to all programming 
languages, is described in Chapter 6 “Program editor” on page 253. 


FBD is used to program the contents of blocks (the user program). What blocks are, 
and how they are created, is described in Chapters 5.2.3 “Block types” on page 156 
and 6.3 “Programming a code block” on page 257. 


8.1.1 Programming with FBD in general 


You use FBD to program the control function of the programmable controller - the 
user program (control program). The user program is organized in different types 
of blocks. A block is divided into sections referred to as “networks”. Each network 
contains at least one logic operation which can also have an extremely complex 
structure. Each network is terminated by at least one box. 


Fig. 8.1 shows the structure of a block with the FBD program. Located at the begin- 
ning of the program is the block header (block title) and the block comment. Head- 
ing and commentare optional. These are followed by the first network with its num- 
ber, heading and comment. Heading and comment are also optional for the 
networks. The first network shows a logic operation as example with AND and OR 
boxes, a memory function within the logic operation, and two assignments as ter- 
mination of the logic operation. The second network shows the processing of 
EN/ENO boxes, of which two are arranged in series. A block is not terminated by a 
special network or function, you simply finish the program input. 


The program editor constructs an FBD network from left to right: Position the first 
program element underneath the network comment and insert further program 
elements at the inputs and outputs. The boxes with binary logic operations can be 
extended by additional inputs. Box outputs cannot be directly connected to each 
other. 


A logic operation must always be terminated, for example by an assignment. The 
assignment controls a binary tag using the result of the logic operation. 
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...» Examples400 [CPU 412-2 PN] > Program blocks >» Examples.FBD » Examples.FBD [FB21] — IZM X 


@: a(S)2] © D '=' 


ie a 


-o “> -{=] 


~ Block title: Example of representation of programming language FBD (function block diagram) 


-w Network 1 shows a combination of binary operations. | 
Network 2 contains an example of the digital functions. 


Network 1: Example of representation of binary operations and memory functions 


w The network contains an SR memory whose set input is controlled bya combination of AND and OR 
functions and whose reset input is preceded byan OR function. There is an AND function at the 
output of the SR memory and then two assignment boxes. 


“Switch-on_ 
manual” — 


“Manual_mode” — 3£ 


“Switch-on_ 
automatic” — 


“Manual_mode* —0 3 


#Motor_memory 
SR 


—s 


*Switch-off_ 
manual” — 
*Switch-off_ 
automatic” — 
“Motor_fault” —© 3¢ “Motor_start™ 
= 
#Enabling — 3 
The command memory for the 
motor control remains set even “Motor_display” 


| = 


if the enable is missing. 


Network 2: Representation of digital functions 
Acorrection value is added to 4 position value, and the result converted to REAL. 


ADD 
Dint 
== EN 
#Position_value — IN1 CONV 
#Adjustment, OUT— #temp_dint Dint to Real 
value — IN2 ENO ———— EN #Floating_point_ 
OUT— number 


#temp_dint — IN 


Fig. 8.1 Structure of a block with FBD program 


“Open” parallel branches can lead out from the top logic operation and not be “wired 
back” to the top logic operation; these are known as “T branches”. In these T branch- 
es, there are certain limitations with regard to which permissible program elements 
can be selected. 
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8.1 Introduction 


Where additional rules apply to the arrangement of special FBD elements, these are 
described in the corresponding sections. 


8.1.2 Program elements of the function block diagram 


Fig. 8.2 shows which types of FBD elements exist: Boxes with binary logic operations 
and standard boxes for processing binary signals, Q boxes for implementing 
memory, timer, and counter functions, and EN/ENO boxes for “complex” functions 
such as arithmetic functions. 


Most program elements must be provided with tags or operand addresses at the 
box inputs and outputs. It is best if you initially position all program elements ina 
logic operation and subsequently label them. 


Binary functions 


The binary control function is implemented by AND, OR and exclusive 

Function OR boxes. The box inputs scan the signal state of the binary tag. There are 

— also scans with special functions such as edge evaluation ("fleeting contact") 
or the comparison of two digital tags which delivers a binary result. 


Standard boxes 


The standard boxes save the binary result of the logic operation. They can be 

Function positioned in the middle or at the end ofa logic operation. Assignments save 

— the result of the logic operation in binary tags. There are also boxes with 
special functions such as edge evaluation of the result of the logic operation. 


Boxes with Q output 


Boxes with a Q output are referred to as "Q boxes". These can have multiple 
Function inputs, as well as extra outputs in addition to the Q output. Examples of these 
—IN1 boxes are the memory functions and the timer and counter functions. 


— IN2 © a 


Boxes with EN input and ENO output 


Processing of these boxes can be enabled by means of the enabling input EN. 


Function The enabling output ENO signals whether processing has been completed 
— without errors. The boxes can have multiple inputs and outputs. Examples of 
—IN1 OuT— _ these boxes are the math functions or the functions for conversion of the 
data type of tags. 
— IN2 ENO —— 
Block calls 
Data The block calls represent the change in processing to a different block. 
Block The box represents the called block with its input and output parameters. 
The block called with the box is processed; processing is subsequently 
——fEN OUT1 —— ___ continued with the next function following the block call. 
— oo — 
— IN2 ENO — 


Fig. 8.2 Overview of program elements of the function block diagram 
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8 Function block diagram FBD 


8.2. Programming binary logic operations with FBD 


The binary logic operations are carried out in the function block diagram using the 
AND, OR, and exclusive OR boxes. The binary tags for the logic operation can be 
scanned for signal state “1” or “0”. The binary results of other boxes can also be 
included, e.g. the evaluation of a signal edge or the comparison of two digital tags 
(Fig. 8.3). 


Binary logic functions 


Scan for Scan for 
signal state “1” signal state “0” Negation 
Binary Function Binary Function 
tag — tag -—O o- 
Exclusive 
AND function OR function OR function 
& >=1 xX 
Positive edge Negative edge Comparison function 
of a binary ta of a binary ta 
ne te Function 
Binary ta’ Binary ta 
ses bose Digital Data type 
P N tag? — 
. im Digital 
Edge trigger flag Edge trigger flag tag2 — — 


Fig. 8.3 Overview of binary logic operations in the function block diagram 


8.2.1 Scanning for signal states “1” and “0” 


The binary functions scan the binary tags at the function inputs before they link the 
signal states together. The scan can be made for signal state “1” or “O”. When scan- 
ning for signal state “1”, the function input leads directly to the box. You can recog- 
nize the scanning for signal state “O” by means of the negation circle at the input of 
the function. 


The example in Fig. 8.4 shows the two “Start” and “Stop” pushbuttons. When 
pressed, they output the signal state “1” in the case of an input module with sinking 
input. The SR function is set or reset with this signal state. 


The “/Fault” signal is not active in the normal case. Signal state “1” is then present 
and is negated by scanning for signal state “0”, and the SR function therefore 
remains uninfluenced. If “/Fault” becomes active, the SR function is to be reset. The 
active signal “/Fault” delivers signal state “0”, which by scanning for signal state “0” 
resets the SR function as signal state “1”. 
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8.2 Programming binary logic operations with FBD 


Example of scans for signal state "1" and signal state "0" 


"/Fault" "Stop" "Start" tL, When pressed, the "Start" and 
"Stop" keys switch the fan on 
and off. They are "1-active" 


b= E- E signals. 
If Fault" becomes active, 
%l1.3 %11.2 %I11.1 the fan is to be switched off 


ei Ce i: On Qe mmm mass =s=-= and remain off. "Fault" is a 

! "0-active" signal. In order to 

' reset the SR function with 

| signal state "1", this input is 

; scanned for signal state "0". 
>=1 | In the example, the 0-active 

| signal is identified by a slash 
; in front of the name. 

I 

I 


Garena eae ess —o* —R Q—! 


The asterisks at the inputs of the function boxes 
indicate an expansion option for further inputs. 


Fig. 8.4 Scanning for signal states “1” and “0” 


8.2.2. Programming a binary logic operation in the function block diagram 


To program a binary logic operation, drag the corresponding symbol (&, >=1, X) 
with the mouse from the program elements catalog under Basic instructions > Bit 
logic operations to the working area. If a logic operation is already present in the 
working area, the program editor indicates with small gray boxes where the logic 
operation may be positioned and with a green box where it is positioned when you 
“let go”. 


A binary logic function has two inputs as standard. If you select the function box 
when programming and then select the Add input command in the shortcut menu 
with the right mouse button, or more simply: Click on the asterisk with the left 
mouse button, then the program editor adds a further input to the function box. 


To program a scan for signal state “O”, drag the negation symbol (invert RLO) with 
the mouse from the program elements catalog under Basic instructions > General to 
a box input. In the same manner you can convert a scan for signal state “O” into a 
scan for signal state “1” or negate the result of logic operation between the boxes. 


You connect a binary tag to the input of a binary logic operation. This can be an 
input, output, bit memory or data bit, a SIMATIC timer or -counter function, or the 
binary output of another function box. Assignment with a constant (TRUE or FALSE) 
is not permissible. 


You can connect further binary function boxes to the output of a binary logic oper- 
ation. To assign the result of logic operation of a function box to a binary tag, posi- 
tion an assign box at the output which you fetch in the program elements catalog 
under Basic instructions > Bit logic operation. 
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8.2.3 AND function 


An AND function is fulfilled if all inputs have the scan result “1”. A description of the 
AND function is provided in Chapter 12.1.3 “AND function, series connection” on 
page 464. 


Fig. 8.5 shows an example of AND functions. The first AND function scans the 
#Fan1.works tag for signal state “1” and the #Fan2.works tag for signal state “O”. The 
two results of the scans are linked according to an AND logic operation. The AND 
function is fulfilled (delivers signal state “1”) if only fan 1 is running. The second 
AND function is fulfilled if only fan 2 is running. 


v Network 3: Display when only one fan is running (1) 


& 
#Fant.works — >=1 
#Fan2.works —0 3¢ —_— 
#Display.onefan_ 
& 1 
#Fani.works —© = 
#Fan2.works — 3_ —— SE — —_— 


Fig. 8.5 Example of ANDing before ORing 


8.2.4 OR function 


An OR function is fulfilled if one or more inputs inputs have the scan result “1”. A 
description of the OR function is provided in Chapter 12.1.4 “OR function, parallel 
connection” on page 465. 


Fig. 8.6 shows an example of OR functions. The first OR function scans the 
#Fan1.works and #Fan2.works tags for signal state “1”. The two results of the scans 
are linked according to an OR logic operation. The OR function is fulfilled (delivers 
signal state “1”) if one of the fans is running or if both fans are running. The second 
OR function is fulfilled if neither of the fans is running. 


Vv Network 4: Display when only one fan is running (2) 


>=1 
#Fant.works — & 
#Fan2.works — 3¢ _ 


#Display.onefan_ 
> 


v 
" 
-_ 


#Fant.works —© = 
#Fan2.works —© 3 — — — 


Fig. 8.6 Example of ORing before ANDing 
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8.2 Programming binary logic operations with FBD 


8.2.5 Exclusive OR function 


An exclusive OR function (antivalence function) is fulfilled if an odd number of 
inputs has the scan result “1”. A description of the exclusive OR function is provided 
in Chapter 12.1.5 “Exclusive OR function, non-equivalence function” on page 465. 


Fig. 8.7 shows an example of an exclusive OR function. The #Fan1.works and 
#Fan2.works tags are scanned at the inputs of the function box for signal state “1”. 
The exclusive OR function is fulfilled (delivers signal state “1”) if only one of the 
fans is running. 


v Network 5: Display when only one fan is running (3) 


#Display.onefan_ 
x 3 


#Fant.works — = 


#Fan2.works — 3_ —_ _ 


Fig. 8.7 Example of an exclusive OR function 


8.2.6 Combined binary logic operations, negating result of logic operation 


The function boxes of the AND, OR, and exclusive OR functions can be freely com- 
bined with one another. Examples are shown in figures 8.5 and 8.6. Together with 
Fig. 8.7, the examples - even if the logic operation is different in each case - show 
the same response: The logic operation is fulfilled if only one of the fans is running. 


Negating result of logic operation 


The output of a function box can be negated, i.e. the result is signal state “1” if the 
logic operation is not fulfilled. It is then possible in a simple manner to generate 


> aNAND function (negated AND function, is fulfilled if at least one input has the 
result of scan “0”), 


> a NOR function (negated OR function, is fulfilled if all inputs have the result of 
scan “0”), and 


> an inclusive OR function (equivalence function, negated exclusive OR function, 
is fulfilled if an even number of inputs has the result of scan “1”). 


Fig. 8.8 shows a NOR function. The OR function is not fulfilled if none of the fans is 
running, and then delivers the signal state “0”. This is negated and assigned to the 
#Display.noFan tag. 


v Network 6: Display when no fan is running 


>=1 #Display.nofan 
#Fant.works — = 


#Fan2.works — 3_ oo = 


Fig. 8.8 Example of a negated function output 
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8 Function block diagram FBD 


8.2.7 T branch 


You can “divide” a logic operation so that it has two different terminations, the re- 
sult being a “T branch”. To program a T branch, use the mouse to drag the Branch 
symbol from the program elements catalog under Basic instructions > General to the 
position at which the T branch is to commence. 


Fig. 8.9 shows a T branch following the lower OR logic operation. The result of logic 
operation at this position is therefore only “0” if no fan is running. This result of 
logic operation is negated, linked according to an AND logic operation to “Clock 2 
Hz”, and controls the #Display.noFan tag. 


v Network 7: Display when only one fan or no fan is running 


>=1 
#Fant.works —0 & 
#Fan2.works —0 3¢ —_— 


eat #Display.onefan 
#Fan1.works — = 


#Fan2.works — 3¢ + — _ 
| & #Display.nofan 


“Clock 2 HZ —3¢ — = 


Fig. 8.9 Example of a T branch in the function block diagram 


8.2.8 Edge evaluation of binary tags 


An edge evaluation detects the change in a binary signal. 


For programming an edge evaluation, drag the symbol for the P or N box with the 
mouse from the program elements catalog under Basic instructions > Bit logic oper- 
ation to the working area. 


The edge evaluation of a binary tag has the signal state “1” for one processing cycle 
if the signal state of the binary tag named above it changes from “0” to “1” (P box, 
rising edge) or from “1” to “0” (N box, falling edge). This “pulse” can be linked fur- 
ther. 


The edge trigger flag is named underneath the edge box. This is a flag or data bit 
which saves the signal state of the binary tag. The signal edge is recognized by 
comparing the signal states of binary tags and edge trigger flags (see also Chapter 
12.2.5 “Edge evaluation” on page 472). 


Fig. 8.10 shows an application of edge evaluation. Let us assume that an alarm has 
“arrived”, i.e. the #Alarm_bit signal changes from “0” to “1”. The #Alarm_memory 
tag is then set and the #Alarm_lamp tag flashes at 0.5 Hz. The alarm memory can 
be reset using an #Acknowledge button. The alarm memory remains reset if 
#Acknowledge has the signal state “0” again and #Alarm_bit is still present. 
#Alarm_memory is only set again by a further positive edge of #Alarm_bit (if 
#Acknowledge then no longer has signal state “1”). 
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8.2 Programming binary logic operations with FBD 


v Network 8:  Setalarm memory with signal edge 


#Alarm_bit #Alarm_memory 
P SR 
—_—s 
#Alarm_bit_ 


edge_memory 


#Acknowledge — R1 Qo— #Alarm_lamp 


“Clock 0,5 HZ —— 3_ — = 


Fig. 8.10 Example of an edge evaluation of a binary tag 


8.2.9 Comparison functions 


A comparison function compares two digital values and delivers a binary signal as the 
comparison result. The comparison result has signal state “1” if the comparison is 
fulfilled, otherwise “O”. The comparison function is described in Chapter 13.3 “Com- 
parison functions” on page 518. 


To program a comparison function, 
drag it with the mouse from the pro- 
gram elements catalog under Basic 
instructions > Comparator operations 
to the working area. You can then use 
drop-down lists to set the comparison 
mode and data type (Fig. 8.11). 


Fig. 8.12 shows two comparison box- ee Becting Wisco: 


es. If the #Measurement_temperature 
tag is above a lower limit and below 
an upper limit, the #Measurement_in_range tag has signal state “1”. 


v Network 9: Measured value in range (without hysteresis) 
>= 
Int 


#Measurement_ 
temperature —~ |N7 & 


#Lower_limit — IN2 —_— 


<= 


Be #Measured_ 
#Measurement_ value_in_range 
temperature — IN1 = 
#Upper_limit — IN2 — # = a 


Fig. 8.12 Example of comparison functions 
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8.3. Programming standard boxes with FBD 


Standard boxes control binary tags such as outputs or bit memories. Standard 
boxes exist for assigning, setting, and resetting a binary tag or for controlling a 
SIMATIC timer or counter function (Fig. 8.13). 


Standard boxes 


Assignment Set box Reset box 


Binary tag Binary tag Binary tag 
= s R 


Standard box with timer response 


SIMATIC timer xx= SP _ Start pulse timer 
Xx SE Start extentend pulse timer 
SD Start on-delay timer 
SS Start retentive on-delay timer 
—i SF Start off-delay timer 


Standard box with counter response 


SIMATIC counter SIMATIC counter 


sc xx xx= CU Countup 
CD Count down 


—= 


Fig. 8.13 Overview of standard boxes available with FBD 


8.3.1 Assign box 


The assign box directly assigns the result of logic operation to the tag above the box. 


For programming, drag the symbol for the assignment with the mouse from the 
program elements catalog under Basic instructions > Bit logic operation to the work- 
ing area. Gray boxes indicate the permissible positioning, a green box identifies the 
position at which the box will be inserted if you release the mouse button. 


The assign box can be used within a logic operation, following a T branch, or as the 
termination of an operation. It can be positioned in series or parallel. The assign 
box requires a preceding logic operation. 


Fig. 8.14 shows the possible arrangements for the assign box. In the logic opera- 
tion, the assign box is used to control the #Display.nofan, #Display.onefan, and 
#Display.twofans tags. Two boxes are connected in parallel at the end of the logic 
operation. They respond identically. 
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8.3 Programming standard boxes with FBD 


v Network 10: Display with several flashing frequencies 


& #Display.nofan 
#Fant.works —0 = & 
#Fan2.works —0 3¢ — — 


w 
- 


> 
“Clock 2 HZ —= 3¢ — 


x #Display.onefan 
#Fant.works — = & 


#Fan2.works —0 3¢ —_— —_— 


“Clock 0,5 HZ — 3¢ _ 


#Display. 
& #Display.twofans Consolet 
#Fan1.works — = ~ 
#Fan2.works — 3 —_— — + = 
#Display. 


Console2 


Fig. 8.14 Example of arrangement of assign box 


8.3.2 Set and reset boxes 


A set or reset box is used to assign signal state “1” or “O” to a binary tag in the case 
of a result of logic operation “1”. A result of logic operation “0” has no effect. 


For programming, drag the symbol for the set or reset box with the mouse from the 
program elements catalog under Basic instructions > Bit logic operation to the work- 
ing area. Gray boxes indicate the permissible positioning, a green box identifies the 
position at which the coil will be inserted if you release the mouse button. 


Set and reset boxes require a preceding logic operation and terminate a logic oper- 
ation. The reset box can also be used to reset a SIMATIC timer or -counter function. 


In Fig. 8.15, #Fan1.start with signal state “1” sets the #Fan1.drive tag. Signal state 
“0” at #Fan1.start has no effect. With signal state “1” at #Fan1.stop, #Fan1.drive is 
reset. Signal state “0” at #Fan1.stop has no effect. As a result of positioning of the 
reset coil after the set coil, the memory response is “reset dominant”: If both tags 
have signal state “1”, #Fan1.drive is reset or remains reset. The enable for starting 


v Network 11: Control fan with S and R boxes 


& & #Fant.drive 
#Fant.enable — 3¢ Ss 
#Fani start — 3 _ 


& #Fant.drive 


R 
#Fant.stop — 3¢ — 


Fig. 8.15 Example of set and reset boxes 
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and stopping is not directly connected to the AND functions in this example, but 
permits the representation of both boxes in one network through the programming 
prior to a T branch. 


8.3.3 Standard boxes with time response 


A standard box with time response is a single element of a SIMATIC timer function. 
The timer function is usually applied as a complete timer box which contains all 
elements. The standard box with time response corresponds to the S input of the 
complete timer box. Attention must be paid to the sequence in the program when 
using the single elements. The time response of these boxes is described in Chapter 
12.3 “SIMATIC timer functions” on page 477. 


For programming, drag the symbol for the corresponding standard box with the 
mouse from the program elements catalog under Basic instructions > Timer opera- 
tions to the working area. 


A standard box with time response requires a preceding logic operation and termi- 
nates a logic operation. It can be connected parallel to all other boxes. Positioning 
at the end of a T branch is also possible. 


The time tag is positioned above the standard box with a time response. This is an 
operand from the range of SIMATIC timers (T). The time value is specified in the 
data format S5TIME at the TV input. 


In Fig. 8.16, the timer “Fan4.delay” is started as a switch-on delay by the positive 
edge of #Fan4.start. Following expiry of the duration (5 s in the example), the fan is 
switched on by #Fan4.drive. If #Fan4.start has the signal state “O” prior to expiry of 
the duration, the fan is not even switched on. 


v Network 12:  Switch-on with delay 


“Fan4.delay” 

& sD 
#Fan4 start — 3} 
S5T#5S — WV 


& #Fan4.drive 


“Fan4.delay’ — 3 _ _ 


Fig. 8.16 Example of a standard box with time response 


8.3.4 Standard boxes with counter response 


Astandard box with counter response is a single element of a SIMATIC counter func- 
tion. The counter function is usually applied as a complete counter box which con- 
tains all elements. The SC box corresponds to the S input of the complete counter 
box, the CU box to the CU input, and the CD box to the CD input. Attention must be 
paid to the sequence in the program when using the single elements. The response 
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8.4 Programming Q boxes with FBD 


of these boxes is described in Chapter 12.5 “SIMATIC counter functions” on page 
495. 


For programming, drag the symbol for the corresponding box with the mouse from 
the program elements catalog under Basic instructions > Counter operations to the 
working area. 


A logic operation is terminated by a standard box with counter response. It can be 
connected parallel to all other boxes. Positioning at the end of aT branch is also pos- 
sible. 


The counter tag is positioned above the standard box with a counter response. This 
is an operand from the range of SIMATIC counters (C). The counter value in data 
format WORD is specified at the CV input, where the numerical range extends from 
W#16#0000 to W#16#0999 or from C#000 to C#999. 


Fig. 8.17 counts the switch-on processes of #Fan1.start with the SIMATIC counter 
“Fan1.number”. The #Acknowledge signal resets the counter to 0. 


v Network 13: Count switch-on processes 


& & “Fant.number™ 
#Enabling — 3¢ cu 


#Fani start — 3s — 


& *Fant.number™ 
sc 


#Acknowledge — 3¢ —_—_ 


Fig. 8.17 Example of standard boxes with counter response 


8.4 Programming Q boxes with FBD 


“Q boxes” is the abbreviation for boxes with an output parameter named “Q”. These 
are the memory boxes SR and RS, the edge evaluations P_TRIG and N_TRIG, and the 
timer and counter functions (Fig. 8.18). 


With Q boxes, the first binary input (and in certain cases the associated parameter) 
must be connected, connection of the other inputs and outputs is optional. 


When using Q boxes as program elements, you can: 


> Program one single box per network, either within the logic operation or as its 
termination 


> Arrange boxes in series by connecting the Q output of one box to a binary input 
of the following box 


> Position boxes following T branches 
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Boxes with Q output 


SR memory box Binary tag RS memory box Binary tag 
SR RS 
—s —R 
— Ri ‘Oy— — si Q— 
Evaluation with P_TRIG Evaluation with N_TRIG 
rising edge falling edge 
ai — CLK Q— nnn, —ek Q— 
Edge trigger flag Edge trigger flag 
SIMATIC timer functions IEC timer functions 
S PULSE TP, TON and TOF 
5_PEXT SIMATIC timer #Local instance "Single instance" 
S ODT 
$_ODTS S_PULSE ee nee 
S$ _OFEDT —5s Bl — = us = 
—tIv BCD — —IN — —“H = 
— — —?PT Q—- —IN Q— 


SIMATIC counter functions IEC counter functions 


S_CUD CTUD, CTU and CTD 
S_CU SIMATIC counter #Local instance "Single instance" 
mee S_CUD CTUD CTUD 
—cu Int Int 
—cpD — CU — CU 
—s w— —cD —cD 
—Pv cv_BCcD — —B QD—  —R QD — 
—R Q— —LD v— —LD (CV! 
— Pv QU— —PV Qu — 


Fig. 8.18 Overview of Q boxes available with FBD 


8.4.1 Memory boxes 


There are two versions of the memory function: as SR box (reset dominant) and as 
RS box (set dominant). With reset dominant, the memory function is reset or 
remains reset if both inputs have signal state “1”. With set dominant, the memory 
function is set or remains set in such a case. The response of the memory box is 
described in Chapter 12.2 “Memory functions” on page 468. 


For programming, drag the SR or RS symbol with the mouse from the program 
elements catalog under Basic instructions > Bit logic operation to the working area. 


Fig. 8.19 shows a binary scaler: Each positive edge of the #Bin_input tag changes 
the signal status of #Bin_output. Thus half the input frequency is present at the 
output. 
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v Network 14: Binary scaler (1) 


& #Bin_output 
#Bin_input— SR 
#Bin_memory —© 3 —_—s 
& 
#Bin_input— 
#Bin_memory — 3 —Ri Qo— 


v Network 15: _ Binaryscaler (2) 


& #Bin_memory 
#Bin_input—o SR 
#Bin_output — 3 —_—s 
& 
#Bin_input—o 
#Bin_output —O s¢ —R Q— 


Fig. 8.19 Example of binary scaler 


8.4.2 Edge evaluation of result of logic operation 


The edge evaluation with Q boxes registers a change in the result of the logic oper- 
ation prior to the box. If the result of the logic operation changes from “0” to “1” 
(rising edge) at the CLK input of the P_TRIG box, signal state “1” is present at the Q 
output for the duration of one program cycle. If the result of the logic operation 
changes from “1” to “O” (falling edge) at the CLK input of the N_ TRIG box, the Q out- 
put is activated for the duration of one program cycle. 


For programming, drag the P_TRIG or N_TRIG symbol with the mouse from the pro- 
gram elements catalog under Basic instructions > Bit logic operation to the working 
area. 


The P_TRIG and N_TRIG boxes require a preceding logic operation and may only be 
positioned within a logic operation. 


In Fig. 8.20, 4#Measurement.Memory is set if #Measurement_temperature exceeds an 
upper limit. In turn, the #Measurement.Memory tag sets the #Measurement.Message 
memory. Setting is carried out in both cases by a pulse with positive edge so that 
acknowledgment is also possible with a set signal present. 


Acknowledgment is also carried out by a pulse so that, with an acknowledgment 
signal present, the measured value memory and the message memory are set if the 
upper limit is exceeded again. 


8.4.3. SIMATIC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
The box of a SIMATIC timer function contains all statements required for the 
sequence. A detailed description of the SIMATIC timer functions is provided in 
Chapter 12.3 “SIMATIC timer functions” on page 477. 
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v Network 16: Measured-value alarm with memory 


>= 
Int 


#Measurement. 
#Measurement_ Memory 
temperature — IN1 P_TRIG SR 
#Upper_limit — IN2 CLK Q—s 
#Measurement. 
Edget 
#Measurement. 
Ack_memory 
P #Measurement. 
—RI Message 
#Measurement. P_TRIG SR 
Edge3 Q—cak o—_s 
# Measurement. 
Edge2 
#Measurement. 


Ack_message 
P 
— Ri Qq— 


#Measurement. 
Edge4 


Fig. 8.20 Example of edge evaluation of the result of the logic operation 


For programming, drag the corresponding symbol S_ PULSE, S_PEXT, S_ODT, 
S_ODTS or S_OFFDT with the mouse from the program elements catalog under 
Basic instructions > Timer operations to the working area. You can subsequently 
change the function using a drop-down list which you can open using the small yel- 
low triangle when the box is selected. 


The start input S and the time value TV must be connected; connection of the other 
box inputs and outputs is optional. 


Fig. 8.21 shows a switch-on and switch-off delay. The timer function “Fan5.on-de- 
lay” is started by #Fan5.start. The Q output has signal state “1” after 3 s, which starts 
the timer function “Fan5.off-delay”. At the same time, the #Fan5.drive tag is started 
by the Q output of the box. The Q output still has signal state “1” for 5 s after 
#Fan5.start has signal state “O”. 


v Network 17: Fan switch-on and offdelay 


“FanS.ondelay” 


S_ODT 
#FanS.startt——S§ BI—... “Fan5.Offdelay” 
S5T#3S — WV ——.. S_PEXT 
— °——_____§ 
Bl — ... #Fan5S.drive 
S5T#5S —V 6cD —... = 
—R Q———$—$—$$$—$———_. — 


Fig. 8.21 Example of SIMATIC timer functions in the function block diagram 
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8.4.4 SIMATIC counter functions 


Counter functions are used to implement counting tasks in the user program. The 
box of a SIMATIC counter function contains all statements required for the 
sequence. A detailed description of the SIMATIC counter functions is provided in 
Chapter 12.5 “SIMATIC counter functions” on page 495. 


For programming, drag the corresponding symbol (S_CUD, S_CU or S_CD) with 
the mouse from the program elements catalog under Basic instructions > Counter 
operations to the working area. You can subsequently change the function using a 
drop-down list which you can open using the small yellow triangle when the box is 
selected. 


At least one of the counter inputs (CU or CD) must be connected; connection of the 
other box inputs and outputs is optional. 


Fig. 8.22 shows a down counter. The name of the SIMATIC counter used is posi- 
tioned above the counter box. #Quantity_set sets the counter to the count value 
W#16#0120. The count value is reduced by 1 with each pulse from #Workpiece_iden- 
tified. Once zero has been reached, #Quantity_reached is set. 


v Network 18: Workpiece counter 


“Piece_counter™ 


s_cD 
#Workpart_ 
identified — CD #Quantity_ 
#Quantity_set— S$ v—... reached 
c#120— PY C_BCD—... = 
aR 09 ————_ — 


Fig. 8.22 Example of SIMATIC counter functions in the function block diagram 


8.4.5 IEC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
With a CPU 400, an IEC timer function is a system function block (SFB) in the oper- 
ating system. A detailed description of the IEC timer functions is provided in Chap- 
ter 12.4 “IEC timer functions” on page 491. 


For programming, drag the corresponding symbol (TP, TON or TOF) with the 
mouse from the program elements catalog under Basic instructions > Timer opera- 
tions to the working area. When positioning, you select either as single instance or 
as local instance. The instance data block generated automatically when selecting 
as a single instance is saved in the project tree under Program blocks > System blocks 
> Program resources. 


You can subsequently change the timer function using a drop-down list which you 
can open using the small yellow triangle when the box is selected. 
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With the IEC timer functions, the IN input must have a preceding logic operation 
and a duration must be connected to the PT input. The Q output can be supplied 
with an assignment, but cannot be linked further. You can also directly access the 
output parameters using the instance data, for example with “DB _name”.Q or 
“DB_name’.ET for a single instance. 


Fig. 8.23 shows the IEC timer function #MessageDelay, which saves its data as local 
instance in the instance data block of the calling function block. If the #Measure- 
ment_too_high tag has a signal state “1” for longer than 10 s, #Message_too_high is 
set. 


v Network 19: Alarm delay 


#MessageDelay 


TON 
mime #Message_too_ 
#Measurement_ high 
too_high — IN eo— = 
T#10S — PT a = 


Fig. 8.23 Example of IEC timer functions in the function block diagram 


8.4.6 IEC counter functions 


Acounter function implements counting processes in the user program. With a CPU 
400, an IEC counter function is a system function block (SFB) in the operating sys- 
tem. A detailed description of the IEC counter functions is provided in Chapter 12.6 
“TEC counter functions” on page 502. 


For programming, drag the corresponding symbol (CTUD, CTU or CTD) with the 
mouse from the program elements catalog under Basic instructions > Counter oper- 
ations to the working area. When positioning, you select either as single instance or 
as local instance. The instance data block generated automatically when selecting 
as a single instance is saved in the project tree under Program blocks > System blocks 
> Program resources. 


You can subsequently change the timer function using a drop-down list which you 
can open using the small yellow triangle when the box is selected. 


With the IEC counter functions, at least one counter input (CU or CD) must have a 
preceding logic operation. Connection of the other box inputs and outputs is 
optional. A standard box can be positioned at the bottom output QU, but not a fur- 
ther logic operation. The QD output cannot be supplied, but can be scanned indi- 
rectly via the corresponding component QD of the counter structure. For the QU 
output, this would be the component QU. 


One can also directly access the output parameters using the instance data, for ex- 
ample with “DB_name”.QD for a single instance. 
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v Network 20: Single lock counter 


#Light_barrier_2 


P & 
#Light_barrier_2_ #LockCounter 
edge_memory cup 
Int 
#Light_barrier_1 — 3 —c 
#Light_barrier_1 
P & 
#Light_barrier_1_ 
edge_memory 
#Light_barrier_2 — 3 —c 
#Acknowledge —R QpD—... 
--—=LD v—... 
O— PV QU— 


Fig. 8.24 Example of IEC counter functions in the function block diagram 


Fig. 8.24 shows the IEC counter function #LockCounter, which is called as a local 
instance. It has saved its data in the instance data block of the calling function block. 
A component of the counter can be addressed globally with the name of the 
instance and the component name, for example #LockCounter.CV. The example 
shows the passages through a lock, either forward or backward. 


8.5 Programming EN/ENO boxes with FBD 


EN/ENO boxes have an enable input EN and an enable output ENO. The enable input 
can be used to control processing of the box. If an error occurs while the box is 
being processed, this is displayed at the enable output. Fig. 8.25 provides an over- 
view of the “basic” functions implemented with EN/ENO boxes. 


The parameters of the EN/ENO boxes must all be connected. The enable input EN 
and the enable output ENO are not parameters of the box function. They are used 
for processing boxes and are added to the box function by the program editor. 


An EN/ENO box can be positioned on its own in a network, with or without connec- 
tion of the EN input or the ENO output. The ENO output can be connected to the EN 
input of the following box or to a binary logic operation. 


If an EN/ENO box is positioned in a T branch, its ENO output can no longer be 
returned to the path at which the T branch commences. 


A detailed description of EN and ENO and how one can use the EN/ENO mechanism 
with self-created blocks can be found in Chapter 8.6.2 “EN/ENO mechanism with 
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Boxes with EN input and ENO output 


Transfer functions Arithmetic functions Math functions 
MOVE ADD, SUB, MUL, DIV, MOD NEG, ABS, SQR, SQRT, LN, EXP, 
SIN, COS, TAN, ASIN, ACOS, ATAN 
MOVE ADD 
—EN  OUT1 — Data type EXP 
—IN ENO — —EN Real 
—IN1 ouis— —EN OUT — 
—h Enos— —IN Ene — 
Conversion functions Shift functions Logical operations 
CONVERT, ROUND, CEIL, SHL, SHR, ROL, ROR AND, OR, XOR, INV 
FLOOR, TRUNC 
SHR XOR 
CONV Data type Data type 
DType to DType —nN — 
—EN ouT— —IN oi— —IN1 OUT — 
——iN ENoy— —iN ENO — — IN2 ENO — 


Fig. 8.25 Overview of boxes with enable input EN and enable output ENO 


FBD” on page 342. The block calls in the function block diagram which are also 
shown as EN/ENO boxes are described in Chapter 14.4 “Calling of code blocks” on 
page 576. 


8.5.1 Transfer function MOVE 


The transfer function MOVE transfers the value of one tag to another. 


For programming, drag the symbol for the MOVE function with the mouse from the 
program elements catalog under Basic instructions > Move operations to the work- 
ing area. 


A detailed description of the transfer function is provided in Chapter 13.2 “Transfer 
functions” on page 508. 


In Fig. 8.26, the #Messages tag is transferred from the data block “Data.FBD” to the 
#Message_bits tag in the memory area. 


SF Network 21: Transfer variable value 


MOVE 
== EN 
“Data.FBD". OUTi — *Message_bits* 
Messages — IN ENO — 


Fig. 8.26 Example of a transfer function in the function block diagram 
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8.5.2 Arithmetic functions 


An arithmetic function for numerical values implements the basic arithmetical 
operations with the data formats INT, DINT, and REAL in the user program. A detailed 
description of these arithmetic functions is provided in Chapter 13.4 “Arithmetic 
functions” on page 521. 


For programming, drag one of the arithmetic functions (ADD, SUB, MUL, DIV, or 
MOD) with the mouse from the program elements catalog under Basic 
instructions > Math functions to the working area. You can set the function (ADD, 
SUB, MUL, DIV, or MOD) and the data type (INT, DINT, or REAL) using drop-down 
lists which you can open using the small yellow triangle when the box is selected. 
The data type is also automatically set when the first actual value is created. 


In Fig. 8.27, the upper limit of a measured value is monitored. A hysteresis is intro- 
duced to ensure that the #Measurement_too_high message does not “pulsate” when 
the measured value changes rapidly around the upper limit. The message #Mea- 
surement_too_high is only canceled when the measured value has dropped again 
below the upper limit by the magnitude of the hysteresis. 


v Network 22: Measured value in range with hysteresis (1) 
SUB 
Int 
EN 
#Upper_limit — IN1 OUT — #temp_int 
#Hysteresis — IN2 ENO — 


ed Network 23: Measured value in range with hysteresis (2) 


>= 


#Measurement_ 


#Measurement_ too_high 
temperature — IN1 SR 
#Upper_limit — IN2 —- 

<= 
Int 

#Measurement_ 

temperature — IN1 
#temp_int — IN2 —RI Qq— 


Fig. 8.27 Example of an arithmetic function in the function block diagram 


8.5.3 Math functions 


The mathematical functions comprise, for example, trigonometric functions, expo- 
nential functions, and logarithmic functions with tags in data format REAL. A de- 
tailed description of these math functions is provided in Chapter 13.5 “Math func- 
tions” on page 527. 


For programming, drag one of the mathematical functions (NEG, ABS, SQR, SQRT, 
LN, EXP, SIN, COS, TAN, ASIN, ACOS, or ATAN) with the mouse from the program 
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4 


Network 24: Calculate reactive power (1) 


MUL 
Real 


--—— EN 
#Voltage — IN1 OUT — #temp_reali 
#Current — IN2 ENO — 


v Network 25: = Calculate reactive power (2) 


SIN 
Real 


= EN OUT — #temp_real2 
#phi — IN ENO — 


v Network 26: Calculate reactive power (3) 


MUL 
Real 


== EN 
#temp_real1 — IN1 OUT — #Reactive_power 
#temp_real2 — IN2 ENO — 


Fig. 8.28 Example of math functions in the function block diagram 


elements catalog under Basic instructions > Math functions to the working area. You 
can set the function (NEG, ABS, SOR, SORT, LN, EXP, SIN, COS, TAN, ASIN, ACOS, or 
ATAN) using drop-down lists which you can open using the small yellow triangle 
when the box is selected. The data type is permanently set to REAL. 


Fig. 8.28 shows the calculation of the reactive power according to the equation 
#Reactive_power = #Voltage x #Current x sin(#phi). 


8.5.4 Conversion functions 


The conversion functions convert the data formats of tags. A detailed description of 
the conversion functions is provided in Chapter 13.6 “Conversion functions” on 
page 531. 


Table 8.1 shows the data type conversions possible with FBD. 


For programming, drag one of the conversion functions (CONVERT, ROUND, CEIL, 
FLOOR, or TRUNC) with the mouse from the program elements catalog under Basic 
instructions > Conversion operations to the working area. You can set the function 
and data types using drop-down lists which you can open using the small yellow tri- 
angle when the box is selected. If the first actual value created has a permissible da- 
ta type, the data type is also set automatically. 


The conversion function T_CONV for data type conversion of date/time can be 
found in the program elements catalog under Extended instructions > Date and 
time_of_day. 


The conversion function S_CONV for data type conversion of character strings can be 
found in the program elements catalog under Extended instructions > String + Char. 
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Table 8.1 Data type conversion with FBD 
to a w (c) 

fom a to = a = a oc - n a e a Co) hi ira) co 
BOOL 

BYTE IX IX 10 

WORD IX Ke) 10 10 

DWORD 10 10 lo 

INT 10 Cc Ss Cc 
DINT ite) Cc 10 Ss Cc 
REAL R Ss 

TIME ite) 10 T 

SSTIME 10 T 

DT T1) T T 

TOD ite) 

DATE 10 

CHAR 10 

STRING Ss Ss Ss 

BCD16 Cc 

BCD32 Cc 

Data type conversion is possible: IX Implicitly and independent of attribute [EC check 


10 

Cc 

R 

T 

Ss 
Additionally: ATH, HTA, SCALE, UNSCALE 


Implicitly with deactivated attribute IEC check 
Explicitly with CONV 

Explicitly with ROUND, CEIL, FLOOR, and TRUNC 
Explicitly with T_CONV, 1) Conversion to day of week 
Explicitly with S_CONV 


Fig. 8.29 shows an example of the conversion functions. A measured value present 
in data format INT is first expanded to the data format DINT and then converted in- 


to the BCD format. 


v Network 27: 


CONV 
Int to Dint 


== EN 


#Measurement_ 


temperature — IN ENO 


OUT — #temp_dint 


Measured-value display BCD 


CONV 
Dint to Bcd32 
EN #Measurement_ 
OuT — display 


#temp_dint — IN ENO — 


Fig. 8.29 Example of conversion functions in the function block diagram 
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8.5.5 Shift functions 


The shift functions shift the content of tags bit-by-bit to the left or right. A detailed 
description of the shift functions is provided in Chapter 13.7 “Shift functions” on 
page 544. 


For programming, drag one of the shift functions (SHL, SHR, ROL, or ROR) with the 
mouse from the program elements catalog under Basic instructions > Shift and 
rotate to the working area. You can set the function (SHL, SHR, ROL, and ROR) and 
data types using drop-down lists, which you can open using the small yellow trian- 
gle when the box is selected. The data type is also automatically set when the first 
actual value is created. 


In Fig. 8.30, the respective three decades of two numbers present in BCD format of 
a SIMATIC counter are joined without gaps. Using the shift function SHL - set to 
data type DWORD! - the #Quantity_high tag is shifted to the left by 12 bits, corre- 
sponding to three decades. A small square on the input parameter IN indicates that 
the data type of the applied tag (WORD in the example) does not agree with the data 
type of the function (DWORD in the example) and has to be converted implicitly. 


The bottom three decades (the #Quantity_low tag) are subsequently added by a 
doubleword logic operation according to OR and output to the #Quantity_display 
tag. Also on this box, a small gray square indicates the implicitly converted data 
type from WORD to DWORD. 


v Network 28: Counted-value display BCD 


SHL 


DWord 
== EN OR 
#Quantity_high —aIN OUT — #temp_dword DWord 
W#16#000C —N ENO ———_—____—— EN 
#temp_dword — IN1 OUT — #Quantity_display 
#Quantity_low —aIN2 ENO — 


Fig. 8.30 Example of shift functions in the function block diagram 


8.5.6 Word logic operations 


The word logic operations link the individual bits of two tags according to an AND, 
OR, or exclusive-OR function. A detailed description of the word logic operations is 
provided in Chapter 13.8.1 “Word logic operations” on page 549. 


For programming, drag one of the word logic operations (AND, OR, XOR, INV) with 
the mouse from the program elements catalog under Basic instructions > Word logic 
operations to the working area. You can set the function and data types using drop- 
down lists which you can open using the small yellow triangle when the box is se- 
lected. The data type is also automatically set when the first actual value is created. 
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Fig. 8.31 shows how you can program 32 edge evaluations simultaneously for ris- 
ing and falling edges. The message bits are collected in a doubleword Messages, 
which is present in data block “Data.FBD”. The edge trigger flags Messages_EM are 
also present in this data block. If the two doublewords are linked by an XOR logic 
operation, the result is a doubleword in which each set bit represents a different as- 
signment of Messages and Messages_EM, in other words: the associated message bit 
has changed. In order to obtain the positive signal edges, the changes are linked to 
the messages by an AND logic operation. The bit is set for arising signal edge wher- 
ever the message and the change each have a “1”. This corresponds to the pulse flag 
of the edge evaluation. 


If you do the same with the negated message bits - the message bits with signal 
state “O” are now “1” — you obtain the pulse flags for a falling edge. 


At the end it is only necessary for the edge trigger flags to track the messages. 


v Network 29: Example of digital edge evaluation (1) 


XOR 
DWord 
= EN 
“Data.FBD*. 
Messages — INT #Messages_ AND 
“Data FED". OUT — changed DWord 
Messages_EM— |IN2 ENO —————— EN 
#Messages_ 
changed — IN1 "Data.FBD". 
"Date.FBD". OUT — Messages_pos 


Messages — IN2 ENO — 


¥ Network 30: Example of digital edge evaluation (2) 


XOR 
DWord 
== EN 
“Data.FBD*. 
Messages — INT #Messages_ AND 
DW#16#FFFF_ OUT— negated —_ 
FFFF — IN2 ENO —————— EN 
#Messages_ 
changed — IN1 “Data .FBD*. 
#Messages el — Messages_neg 


negated — IN2 ENO — 


v Network 31: Example of digital edge evaluation (3) 


MOVE 
-— “Data FED". 
“Data.FBD*. OUT! — Messages_EM 
Messages — IN ENO — 


Fig. 8.31 Example of word logic operations in the function block diagram 
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8.6 Controlling the program flow with FBD 


You can influence processing of the user program by means of the program flow 
control functions. The available functions are shown in Fig. 8.32. 


8.6.1 Working with status bits in the function block diagram 


Scanning status bits 


Status bits provide information on the result of an arithmetic function and on any 
errors, for example exceeding a numerical range. Chapter 14.1.5 “Evaluating the 
status bits” on page 566 describes how you can use scan boxes to scan the signal 
state of the status bits. 


Functions for program flow control 


Scan status bit 


Status bit 


Save binary result 


SAVE 


Jump functions 


Block end function 


Calling a function (FC) 


Target Target RLO 
JMP JMPN RET 
Select data block Change block 
Data block Data block Logic block 
OPN OPNI CALL 
Block calls 


Calling a function block (FB) 


DB_name 

FC_name FB_name 
— EN — EN 
— param_1 — param_1 
—= param_3 — se param_3 — 
— param_2 —— — param_2 —— 
—e ENO — —_—= ENO — 

Master control relay 
Activate MCR zone Open MCR zone Close MCR zone Deactivate MCR zone 

MCRA MCR< MCR> MCRD 


Fig. 8.32 Overview of functions for program flow control in the function block diagram 
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For programming, drag the symbol labeled Status with the mouse from the pro- 
gram elements catalog under Basic instructions > Further instructions to the working 
area. You can set the status bit to be scanned (OV, OS, UO, BIE, ==0, >=0, <=0, >0, <0, 
and <>0) via a drop-down list which you can open using the small yellow triangle 
when the box is selected. 


Example: In Fig. 8.33, a floating-point number is checked for validity. To do this, the 
tag is compared with any floating-point constant. The type of comparison does not 
play a role here. If the floating-point number is invalid, the comparison is incorrect 
in all cases and the status bit OV (overflow) is set. Thus if the comparison is incorrect 
and the overflow bit is set, the intermediate memory #Floating_point_number_invalid 
is set and the JMP jump) to the Error label is carried out. 


v Network 32: Check floating-point number 


Real 


#Floating_point_ 
number — IN1 & 


1.0 — IN2 o— #Floating_point_ 
number_invalid Error 


ov = JMP 


Fig. 8.33 Example of scanning a status bit 


Save binary result 


With the SAVE box you can save the result of logic operation RLO in the binary result 
BIE. A detailed function description of the SAVE box is provided in Chapter 14.1.4 
“Controlling the binary result” on page 565. 


For programming, drag the SAVE box with the mouse from the program elements 
catalog under Basic instructions > Further instructions to the working area and, if ap- 
plicable, set the SAVE function via a drop-down list which you can open using the 
small yellow triangle when the box is selected. 


The SAVE box requires a preceding logic operation and is present alone in a logic 
operation. A T branch must not be programmed in the network with a SAVE box. 
Note that the SAVE box does not terminate the logic operation, and therefore the 
logic operation can be continued in the following network. 


You can control the ENO output of the block with the SAVE box if you call the box in 
the last network of the block. In the example in Fig. 8.36 on page 344, the error mes- 
sages are collected in the last network of the block: #Floating_point_number_invalid 
(error with “1”) and #Adder_error (error with “O”). The logic operation must not be 
fulfilled with an error; in this case signal state “O” is transferred by the SAVE box to 
the ENO output. 
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8.6.2. EN/ENO mechanism with FBD 


With FBD, all block calls and functions (statements) for which an error can occur 
have an enable input EN and an enable output ENO. 


The EN input and the ENO output are not block parameters and are not declared. 
They are statement sequences which the program editor generates in the program 
before and after a block or function call. They are not visible to the user. The EN input 
and the ENO output are both of data type BOOL. 


You can use the properties of EN and ENO to connect several boxes into a sequence, 
where the enable output ENO leads to the enable input EN of the next box. In this 
manner it is possible, for example, to “switch off” the complete sequence, or the 
rest of the sequence is no longer processed if a box signals an error. 


Controlling a processing sequence 


In the example in Fig. 8.34, neither of the boxes is processed if the #Enabling tag has 
signal state “O”. If an error occurs during processing of the ADD box, for example a 
numerical range is exceeded, the subsequent SQRT box is no longer processed. 


v Network 33: Control processing sequence 


ADD 
Real 
#Enabling — EN SQRT 
#var_a—IN1 OUT — #temp_real Real 
#var_b — IN2 ENO ——_—_—_$_$$——————————————_ EN 
OUT — #var_c 
#temp_real — IN ENO — 


Fig. 8.34 Example of series connection of ENO and EN with FBD 


Enable input EN 


You can control the calling of a block using the enable input EN. If EN has signal 
state “1” or is not connected, the called block is processed. If EN has signal state “0”, 
the called block is not processed. A jump is then made beyond the block call to the 
next following statement (function). 


Enable output ENO 


You can scan the error status of the block using the enable output ENO. If ENO has 
signal state “1”, processing has been carried out correctly. With signal state “0”, the 
ENO output signals that the block was not called (EN was “O”) or that an error is 
present in the block (Fig. 8.35). 


The ENO output has the signal state which the binary result BIE had in the block. 
With self-created blocks, you can control the assignment of the ENO output via the 
binary result in order, for example, to signal faulty processing in the block. 
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Is EN connected? 
YES 


Block/function being processed 


Block/function being processed Block/function not 
being processed 
Has an error occurred? Has an error occurred? 


YES NO YES NO 
ENO output is ENO output is ENO output is ENO output is ENO output is 
set to “0” set to “1” set to “0” set to “0” set to “1” 


Fig. 8.35 Schematic diagram for setting of enable output ENO 


Example: In Fig. 8.36 on page 344, in the first network the #Adder_error tag is set to 
signal state “O” in the event of an error in the “Adder.FBD” block, and a jump is made 
to the Error label. 


The jump label Error is present in the last network of the block. The binary result 
BIE, and thus also the ENO output of the current block, are set to signal state “0” 
here by means of the SAVE box. 


8.6.3 Jump functions 


For programming a jump function, drag the symbol of a jump function with the 
mouse from the program elements catalog under Basic instructions > Program con- 
trol operations to the working area. You define the jump label (the jump destina- 
tion) using the jump box. To program the jump destination, use the mouse to drag 
the Label function to the start of the network with which processing of the program 
is to be continued from the program elements catalog under Basic instructions > 
Program control operations and write the label into the box. 


You can subsequently set the jump function JMP or JMPN) via a drop-down list 
which you can open using the small yellow triangle when the box is selected. If the 
box with the jump function JMP does not have a preceding logic operation, the jump 
is always carried out (absolute jump). The jump function JMPN always requires a 
preceding logic operation. 


The jump functions cannot be programmed in association with a T branch. Only 
one jump statement is permissible per network. If you use the Master Control Relay 
(MCR), the jump destination must be located in the same MCR zone or in the same 
MCR area as the jump function. 


A detailed description of the jump functions is provided in Chapter 14.2 “Jump 
functions” on page 568. 


Fig. 8.33 on page 341 and Fig. 8.36 on page 344 show examples of the jump func- 
tions. In the first example, a jump is carried out by means of a JMP coil to the Error 
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label upon a result of logic operation “1”. In the second example, a jump is also 
carried out by means of a JPMN coil to the Error label upon a result of logic opera- 
tion “0”. 


8.6.4 Block functions 


Block end function, RET box 


To program the block end function, drag the RET box with the mouse from the 
program elements catalog under Basic instructions > Program control operations to 
the working area. Above the RET box, RLO (result of logic operation) indicates that 
the result of the logic operation present in front of the RET box is assigned to the 
ENO output of the block which has been left. 


A detailed description of the RET box is provided in Chapter 14.3 “Block end func- 
tions” on page 575. 


The RET box requires a preceding logic operation and must only terminate a logic 
operation on its own. 


v Network 34: FC call and jump in event of fault 


“Adder.FBD" 

EN 
“Data.FBD". 
Quantity{1] — Number_1 
“Data.FBD". 
Quantity{2] — Number_2 "Date.FBD". #Adder_error Error 
“Data FED". Result — Adder_result = JMPN 
Quantity{3] — Number_3 ENO ———_—_<_< —_—_————— — 


v Network 35: FB call as single instance and RET coil 


“DB_Totalizer.FBD* 


“Totalizer.FBD" 
= EN 

“Data.FBD". 
Measurement([1] — Valuet 

“Data .FBD". 
Measurement([2] — Value2 "“Data.FBD". RLO 

“Data FED". Sum — Totalizer_result RET 
Measurement[3] — Value3 ENO 


v Network 36: Signal fault via ENO 


Error 


#Floating_point_ 
number_invalid -o SAVE 


#Adder_error — 3 _ 


» Network 37: Block end 


Fig. 8.36 Examples of functions for program flow control in the function block diagram 
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In the second network in Fig. 8.36, the block with the RET box is left if the “Adder” 
block does not signal an error. 


Open data block, OPN and OPNI boxes 


To program the OPN or OPNI box, drag it with the mouse from the program ele- 
ments catalog under Basic instructions > Program control operations to the working 
area. With OPN you open a data block via the DB register, with OPNI via the DI reg- 
ister. 


You can subsequently set the function (OPN or OPNI) via a drop-down list which you 
can open using the small yellow triangle when the box is selected. 


The OPN or OPNI box is present alone in a network without a preceding logic oper- 
ation. 


A detailed description of the OPN or OPNI box is provided in Chapter 14.5.1 “Open- 
ing a data block” on page 583. 


Opening a data block using block parameters 


A block parameter with parameter type BLOCK_DB allows the transfer of a data 
block (or more precisely: a data block number) to the called block. You call this data 
block as a global data block in the called block with the OPN box via the DB register. 


Calling of a data block transferred with BLOCK_DB is not possible via the DI register. 


Block change, CALL box 


To program the CALL box, drag it with the mouse from the program elements cata- 
log under Basic instructions > Further instructions to the working area. With CALL, 
you call a code block which must not have any block parameters. 


The CALL box is present alone in a network. If the CALL box does not have a preced- 
ing logic operation, the block call is carried out without conditions. 


A detailed description of the CALL box is provided in Chapter 14.4.4 “Change to a 
block without block parameter” on page 581. 


Block call functions 


Calling of blocks is represented by EN/ENO boxes. With functions (FC), the block 
name is present quasi as a function name in the box; with function blocks, the in- 
stance name (the name of the instance data block or the name of the local instance) 
is additionally present above the box. A detailed description of the block calls is pro- 
vided in Chapter 14.4 “Calling of code blocks” on page 576. 


To call a code block, use the mouse to drag the block which has already been 
programmed from the project tree under Program blocks into the working area. 
With a logic operation preceding the EN input you can structure the block call 
depending on conditions. 
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Network 29 in Fig. 8.36 shows the call of a function (FC). The function name is pres- 
ent as the title in the call box. In the event of an error in the block (ENO is then “0”), 
#Adder error is set to “O” and a jump made to the network with the Error label. In 
network 30, the call of a function block is present as a single instance. The name of 
the function block is present as the title in the call box, the instance name - in this 
case the name of the instance data block - is present above the box. 


8.6.5 Master Control Relay (MCR) 


The Master Control Relay controls write operations to the user memory. A detailed 
description of the MCR functions is provided in Chapter 14.6 “Master control relay” 
on page 587. 


You use the MCRA and MCRD boxes to define an MCR area. The two boxes are each 
present alone in a network. 


You use the MCR< box to open an MCR zone. The box requires a preceding logic 
operation and terminates a logic operation. If the result of the logic operation is = “1”, 
the MCR dependency is switched off (“normal” processing); if the RLO = “0”, the MCR 
dependency is switched on. 


v Network 38: Master Control Relay (1) Activate MCR dependency 
MCRA 


v Network 39: Master Control Relay (2) Switch on MCR zone 


MCR< 


#*°MCR-Zone_ 
switch-on* — 


Vv Network 40: Master Control Relay (3) Program in the MCR zone 


v Network 41: Master Control Relay (4) Switch off MCR zone 


MCR> 


v Network 42: Master Control Relay (5) Deactivate MCR dependency 
MCRD 


Fig. 8.37 MCR dependency and MCR zone in the FBD representation 
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The MCR> box closes an MCR zone and is present alone in a network. 


To program the corresponding MCR function, drag it with the mouse from the 
program elements catalog under Basic instructions > Further instructions to the 
working area. You can subsequently set the function (MCR<, MCR>, MCRA, or 
MCRD) via a drop-down list which you can open using the small yellow triangle 
when the coil is selected. 


Fig. 8.37 shows the functions and networks required to switch the MCR dependency 
on and off. 


If MCR dependency is switched on, the following system blocks influence the oper- 
ands in the I/O range, in the process image, and in the bit memory address area: 


> SET, SETI, and SETP set the parameterized operands to signal state “1”, 
> RESET, RESETI, and RESETP reset the parameterized operands to signal state “O”. 


The system blocks can be found in the program elements catalog under Basic 
instructions > Further instructions. A detailed description of these blocks is provided 
in Chapter 13.2.6 “Control memory area with MCR dependency” on page 515. 
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9 Statement list STL 


9.1 Introduction 


This chapter describes programming with statement list (STL); it uses examples to 
show how the program functions are represented in STL. You can find a description 
of the individual functions, e.g. comparison functions, in Chapters 12 “Basic 
functions” on page 461, 13 “Digital functions” on page 507, and 14 “Program flow 
control” on page 560. 


Use of the program and symbol editor, which generally applies to all programming 
languages, is described in Chapter 6 “Program editor” on page 253. 


STL is used to program the contents of blocks (the user program). What blocks are, 
and how they are created, is described in Chapters 5.2.3 “Block types” on page 156 
and 6.3 “Programming a code block” on page 257. 


9.1.1 Programming with STL in general 


You use STL to program the control function of the programmable controller - the 
user program (control program). The user program is organized in different types 
of blocks. A block can be divided into sections referred to as “networks”. Networks 
are not required for functioning of the user program, but they do increase the clar- 
ity. 

Fig. 9.1 shows the structure of a block with the STL program. The block header 
(block title) and the block comment are located at the beginning of the program. 
These are followed by the first network with its number, heading, and comment. 
Further networks are optional. The first network shows a logic operation as exam- 
ple with AND and OR statements, a memory function, as well as an AND function 
with two assignments as termination. The second network shows the processing of 
digital values. Two digital values with data type DINT are added and the result con- 
verted to REAL before being transferred to a variable. A block need not be terminat- 
ed by a special function, you simply terminate the program input. 


The program editor constructs an STL program line by line. You write the first state- 
ment in the network working area, the second statement underneath this, and so 
on. Comments are commenced by two slashes, either as a line comment or a state- 
ment comment. You can insert empty lines to structure the sequence of statements. 
These and the comments have no effect on the control function. 
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...Examples400 [CPU 412-2 PN] > Program blocks >» Examples.STL > Examples.STL [FB31] — 1 Mi X 


axes & Bo Ms BER COD 's' 


Ts) 
~ Block title: Example of representation of programming language STL (statement list) 


w Network 1 shows a combination of binary operations. 
Network 2 contains an example of the digital functions. 


Network 1: Example of representation of binary operations and memory functions 


w The network contains a memory function whose set input is controlled bya combination of AND 
and OR functions and whose reset input is preceded byan OR function. An AND function controls 
two assignments. 


//Control motor_memory 
“Switch-on_manual" 
“Manual _ mode" 


oom ON 


“Switch-on_automatic” 
“Manual mode” 
#Motor_memory //Set memory 


6 
7 
8 


“Switch-off_manual" 
“Switch-off_automatic” 
“Motor_fault” 

#Motor_memory //Reset memory 


° 


//Control motor Start and motor display 
#Motor_memory //Scan memory 
#Enabling 
"Motor_start™ 
"Motor_display” 


Network 2: Representation of digital functions 
Acorrection value is added to a position value, and the result converted to REAL. 


L #Position_value 
#Adjustment_value 
//DINT addition 
//Conversion DINI to REAL 
#Floating_point_number 


oom WN bP 


Fig. 9.1 Structure of a block with STL program 


In order to program an STL statement, use the keyboard to enter the operation ina 
line of the input field. Dragging the operation with the mouse from the program 
elements catalog under Basic instructions > Basic instructions > Bit logic operation is 
more laborious with STL then the direct input. However, the program elements cat- 
alog provides you with an overview of the existing operations. 


9.1.2 Structure of an STL statement 


The STL program consists of a sequence of individual STL statements. A statement 
is the smallest independent unit of the user program. It represents a procedural 
specification for the CPU. Fig. 9.2 shows the structure of an STL statement. 
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Structure of an STL statement 


STL statement 
A 


c \ 


Label Operation Operand / tag Comment 


MO01: L %oIW 12 Load analog value 1 


= ~~ 
Identifier Address 


"ANALOG_VALUE_1" 


Xv J 


Symbol address 


Fig. 9.2 Components of an STL statement 


An STL statement consists of 


> Ajump label (optional) which must end with a colon. 


> An operation which describes what the CPU has to do (e.g. load, scan and link 
according to AND logic operation, compare, etc.). 


> An operand which contains the information necessary for executing the opera- 
tion (e.g. an absolutely addressed operand %IW12, a symbolically addressed tag 
ANALOGVALUE._1, a constant W#16#F001, a jump label, etc.). The operand can 
also be omitted depending on the operation. 


> Acomment (optional), commenced by two slashes and up to the end of the line 
(only printable characters, no tabulators). 


With a block call, the call operation is followed by the parameter list in round brackets. 


9.2 Programming binary logic operations with STL 


The binary logic operations are carried out in the statement list using the AND, OR, 
and exclusive OR statements. The binary tags for the logic operation can be scanned 
for signal state “1” or “O”. The binary operations can be “nested” using parenthe- 
sized expressions and thus influence the processing sequence (Table 9.1). 


9.2.1 Processing of a binary logic operation, operation step 


A binary logic operation consists of scan operations and conditional operations. 
The sequence of scan operations and subsequent conditional operations is referred 
to as an operation step (Fig. 9.3). 


The first scan operation processed following a conditional operation is the first input 
bit scan. This is of special significance because the control processor directly imports 
the scan result of this statement as the result of logic operation. The “old” result of 
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Table 9.1 Binary logic operations with STL 


Operation | Operand Function 

A Binary operand Scan for signal state “1” and link according to AND logic operation 

AN Binary operand Scan for signal state “O” and link according to AND logic operation 

fe) Binary operand Scan for signal state “1” and link according to OR logic operation 

ON Binary operand Scan for signal state “O” and link according to OR logic operation 

X Binary operand Scan for signal state “1” and link according to exclusive OR logic operation 
XN Binary operand Scan for signal state “O” and link according to exclusive OR logic operation 
A( - Left parenthesis with AND logic operation 

AN( Left parenthesis with negation and AND logic operation 

oC Left parenthesis with OR logic operation 

ON( Left parenthesis with negation and OR logic operation 

x( Left parenthesis with exclusive OR logic operation 

XN( Left parenthesis with negation and exclusive OR logic operation 

) Right parenthesis 

(@) - ORing of AND functions 

NOT - Negation of result of logic operation 

SET Set result of logic operation to “1” 

CLR Set result of logic operation to “0” 


logic operation is thus lost. The first input bit scan always represents the beginning 
of a logic operation. The logic operation (AND, OR, exclusive OR) specified in the first 
input bit scan does not play any role here. 


The result of logic operation is generated by the scan operations. You scan the signal 
state of a binary operand for “1” or “O” and link it according to AND, OR or exclusive OR. 
The result of this logic operation is saved by the control processor as the new result of 
logic operation. 


Operation step 


The result of a logic operation is 
is : generated and evaluated in an operation 
= "Fanl" Conditional operation step 
U "Manual mode" First scan The operation step commences with the 
U "Manual_on" Scan operation first scan which is the first scan operation 
a) following a conditional operation. 
wm This is followed by scan operations which 
s generate the result of the logic 
| UN "Manual mode" operation. 
3 , ee F 
a | ol WANtO on" Scan operation The conditional operations process the 
a ae Z result of the logic operation. 
§ s "Fan2" Conditional operation : gic Op ; 
A new operation step commences with 
the subsequent scan operation which is 
= "Display" Conditional operation againa first scan. 
U "Fanl" First scan 
U "Enable" Scan operation 


Fig. 9.3 Binary logic operation with STL, definition of operation step 
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Conditional operations are operations whose execution depends on the result of 
logic operation. These are operations for assigning, setting and resetting binary 
operands, for starting timers and counters, etc. The conditional operations (apart 
from a few exceptions) are executed if the result of logic operation (RLO) is “1” and 
not executed if RLO is “0”. They do not change the RLO (apart from a few excep- 
tions), and therefore the RLO is the same for several successive conditional opera- 
tions. 


Understandable programming 


The logic operation specified for a first input bit scan is of no importance since the 
result of the scan is imported directly as the result of logic operation. To make the 
programming understandable, the logic operation specified for a first input bit 
scan should be identical to the desired function. 


As an example, the sequence of statements 


Fanl.start 


O Enable //First AND function 
A Fan2.on 

S HenZisteare 

A Enable //Second AND function 
A Pate core 

R 


Fan2.start 


represents two AND functions, where you should prefer the programming of the 
second AND function in which both scans are programmed according to AND. 


For individual scan statements, the AND function is preferred, for example with 


#Fanl.display 


ad 


#Fan2.running //Scan of #Fan2.running with 
#Fan2.display //assignment to #Fan2.display 


9.2.2 Scanning for signal states “1” and “0” 


Before the scan operations link the signal states together, they scan the status of the 
associated binary tags. 


The status of a binary tag is identical to the signal state of the binary tag. This can 
be “0” or “1”. The physical variable at the module terminal for which an input has 
signal state “1” or “O” depends on the type of input module (see Chapter 12.1.2 
“Working with binary signals” on page 462). 


Strictly speaking, the control processor does not link the signal state of the binary 
tag scanned, it initially generates a scan result. When scanning for signal state “1”, 
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the scan result is identical to the signal state of the binary tag scanned. When scan- 
ning for signal state “O”, the scan result is the negated signal state of the binary tag 
scanned. Scans for signal state “O” have an “N” following the specified logic opera- 
tion (AN, ON, XN). The control processor generates the result of logic operation 
from the logic operation of the scan results. 


The result of logic operation (RLO) is the signal state used by the control processor 
for further binary signal processing. The RLO contains the state of the binary logic 
operation: “1” means that the operation is fulfilled; “O” means that the operation is 
not fulfilled. The result of logic operation is used to set or reset binary tags. 


The example in Fig. 9.4 shows the two “Start” and “Stop” pushbuttons. When 
pressed, they output the signal state “1” in the case of an input module with sinking 
input. The SR function is set or reset with this signal state. 


Example of scans for signal state "1" and signal state "0" 


“/Fault" "Stop" "Start" t+ When pressed, the "Start" and 
"Stop" keys switch the fan on 
and off. They are "1-active" 


Ee EA E signals. 
If "/Fault" becomes active, 
%11.3 %11.2 %11.1 the fan is to be switched off 


ShQhew rn pe Ose oe ee SRG HS PRE EMSS ES SGU SS Sars -. and remain off. "/Fault" is a 
: U "Start" "0-active" signal. In order to 
Fi reset the R operation with 


i f 

re 

roy, 4, (SW REEW oT I. oh . 

: ; wpeve ‘ ' signal state "1", this input is 
oy (oh ae 0 "Stop" I ; scanned for signal state "0". 
Beene Stas hes aa age ; In the example, the 0-active 

i On Mimevethe | ; signal is identified by a slash 
I Rac — — — — 1 ; in front of the name. 


Fig. 9.4 Scanning for signal states “1” and “0” 


The “/Fault” signal is not active in the normal case. Signal state “1” is then present 
and is negated by scanning for signal state “0”, and the reset operation therefore 
remains uninfluenced. If “/Fault” becomes active, the “Fan” tag is to be reset. The ac- 
tive signal “/Fault” delivers signal state “O”, which by scanning for signal state “O” 
activates the reset operation as signal state “1”. 


9.2.3. Programming a binary logic operation in the statement list 


The program editor creates a two-line input field in an empty network into which 
you can enter the STL statements. 


Following input of the operation in a line, enter a space and then - if necessary - 
the operand; in the case of a binary logic operation, enter a binary tag from the op- 
erand areas: inputs, outputs, bit memories, and data. Binary logic operations can 
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also be used to scan SIMATIC timer and counter functions, and status bits. The pro- 
gram editor supports you during input of operands by displaying all suitable, 
previously programmed tags following input of the first character. 


In the same line you can enter a comment, separated by two slashes, up to the end 
of the line. 


You terminate the binary logic operation with one or more conditional operations. 


You can start the next logic operation directly in the next line, or you can leave an 
empty line for clarity reasons. You can also commence a new network. 


9.2.4 AND function 


An AND function is fulfilled if all binary tags have the scan result “1”. A description 
of the AND function is provided in Chapter 12.1.3 “AND function, series connection” 
on page 464. 


Fig. 9.5 shows an example of an AND function. The #Fani.running and 
#Fan2.running tags are scanned for signal state “1”, and the two results of the scans 
are linked according to an AND logic operation. The AND function is fulfilled (deliv- 
ers signal state “1”) if both fans are running. 


anl.running 


> Pp 


an2.running 


Il 
iS) 
far 
n 

'O 


lay.twoFans //Two fans are running 


anl.running 


©} 1S} 


an2.running 


I 
(s) 
(ae 
n 

ue) 


lay.MinOneFan //At least one fan is running 


anl.running 


x xX 
a} 


Fan2.running 


Display.oneFan //Only one fan is running 


Fig. 9.5 Example of binary logic operations with STL 


9.2.5 OR function 


An OR function is fulfilled if one or more inputs have the scan result “1”. A descrip- 
tion of the OR function is provided in Chapter 12.1.4 “OR function, parallel connec- 
tion” on page 465. 


Fig. 9.5 shows an example of an OR function. The #Fan1.running and #Fan2.running 
tags are scanned for signal state “1”, and the two results of the scans are linked 
according to an OR logic operation. The OR function is fulfilled (delivers signal state 
“1”) if one of the fans is running or if both fans are running. 


9.2.6 Exclusive OR function 


An exclusive OR function (antivalence function) is fulfilled if an odd number of 
inputs has the scan result “1”. A description of the exclusive OR function is provided 
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in Chapter 12.1.5 “Exclusive OR function, non-equivalence function” on page 465. 


Fig. 9.5 shows an example of an exclusive OR function. The #Fan1.running and 
#Fan2.running tags are scanned for signal state “1”, and the two results of the scans 
are linked by an exclusive OR logic operation. The exclusive OR function is fulfilled 
(delivers signal state “1”) if only one of the fans is running. 


9.2.7 Combined binary logic operations 


The AND, OR, and exclusive OR functions can be freely combined with one another. 
The control processor processes an AND function with higher priority than an OR 
function (ANDing before ORing, like in the notation of Boolean algebra). The exclu- 
sive OR function has the same priority as an OR function. 


The parentheses operations and the individual OR logic operation are available to 
bypass this processing priority. 


ORing of AND functions 
The individual OR logic operation O links the results of two AND functions. 


Fig. 9.6 shows two AND functions with two inputs each, and the results of the logic 
operation are linked according to an OR logic operation. The first AND function is 
fulfilled if fan 1 is running and fan 2 is not running, the second function if fan 1 is 
not running and fan 2 is running. The #Display.oneFan_1 tag is set if the first AND 
function is fulfilled or if the second AND function is fulfilled (or if both are fulfilled, 
but this is not the case in this example). 


A #Fanl.running 

AN #Fan2.running 

O //ORing of AND functions 
AN #Fanl.running 

A #Fan2.running 

= #Display.oneFan_1 //Only one fan is running 


Fig. 9.6 Example of ORing of AND functions 


ANDing of OR functions 


A parenthesized expression is required for the ANDing of OR functions. The OR 
functions are written in parentheses, and their results of the logic operation are 
linked to the operation present next to the parentheses (the AND function in this 
case). 


Fig. 9.7 shows two OR functions: The first one is fulfilled if at least one fan is run- 
ning or if both fans are running, the second one if at least one fan is not running or 
if neither fan is running. Each OR function itself stands in a parenthesized expres- 
sion. The logic operation results of the OR functions are - due to the operation “A(’” 
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- connected according to AND. The #Display.oneFan_2 tag is set if only one of the 
fans is running. 


A ( 

O Fanl.running 

O Fan2.running 

) 

A( //ANDing of OR functions 
ON Fanl.running 

ON Fan2.running 

) 

= Display.oneFan 2 //Only one fan is running 


Fig. 9.7 Example of ANDing of OR functions 


Parenthesized expressions in binary logic operations 


The example in Fig. 9.7 clearly indicates the generally applicable schema for binary 
parenthesized expressions. The function to be processed “first” is present in a pa- 
renthesis. How the result of the logic operation of the parenthesis is to be processed 
further is shown by the logic operation specified in front of the left parenthesis 
operation. Fig. 9.8 is a general representation of this schema. 


A parenthesized expression can be linked by the operation “A(” according to AND, 
by the operation “O(” according to OR, and by the operation “X(’” according to ex- 
clusive OR. Just like with scanning for signal state “0”, implicit negation of the sig- 
nal state is also possible here: The operation “AN(” negates the signal state of the 
parenthesized expression prior to linking, as do the operations “ON(” and “XN(’. 


Any logic operations can be present within the parenthesized expression, including 
operations with parenthesized expressions. The nesting depth has a value of seven, 
i.e. a parenthesized expression can be commenced up to seven times without it be- 
ing necessary to first terminate a parenthesized expression. Any number of paren- 
thesized expressions can be programmed “in succession” (on one level). 


Conditional operations in parenthesized expressions 


All STL operations can be programmed within a parenthesized expression. The use 
of conditional operations such as assignment or setting/resetting is of interest in 
association with binary logic operations. Note that only the result of logic operation 
may be linked further which is valid with the right parenthesis operation. 


In Fig. 9.9, a memory function is programmed with set and reset operations within 
a parenthesized expression. The signal state of the memory function must be 
scanned in order to link it further; this is carried out using the scan operation in 
front of the right parenthesis operation. The resulting AND function has three in- 
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Processing a binary parenthesized expression 


Logic operation 1 


Parenthesis function ( 


Logic operation 2 


Further logic operation 


Delivers RLO 1 


Delivers RLO 2 
Following the parenthesis: RLO 3 


The logic operation prior to the 
parenthesized expression delivers 
a result of logic operation RLO 1, 
which is saved during processing 
of the left-parenthesized operation. 


The logic operation in the 
parenthesized expression delivers 
aresult RLO 2. This result is gated 
with the saved RLO 1 in accordance 
with the specification present in 
the left-parenthesized operation. 


The result of the logic operation 
following the parenthesis is 
therefore: 


Fig. 9.8 Generally applicable schema for the processing of binary parenthesized expressions 


puts: the OR function in front of the parenthesis, the signal state of the memory 
function in the parenthesis, and the last scan operation with the flashing frequency. 


Enable manual 
Enable auto 


Oo) isle” 
isplayl 


//OR function is first AND input 


//Set memory 


//Reset memory 


//Scan memory! 


//Memory state is second AND input 


//Flashing pulse is third AND input 


Fig. 9.9 Example with conditional operations in a parenthesized expression 


9.2.8 Control of result of logic operation 


Ne 


gate RLO 


The NOT operation negates the result of logic operation at any position in an oper- 
ation. Using the NOT operation it is possible in a simple manner to obtain: 


> aNAND function, i.e. anegated AND function, which is fulfilled if at least one in- 
put has the scan result “O”, 
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> aNOR function, i.e. anegated OR function, which is fulfilled if all inputs have the 
scan result “0”, and 


> aninclusive OR function (equivalence function), i.e. anegated exclusive OR func- 
tion which is fulfilled if an even number of inputs has the scan result “1”. 


The response of the negation is described in Chapter 12.1.6 “Negate result of logic 
operation, NOT contact” on page 466. 


Fig. 9.10 shows a NOR function. The OR function is not fulfilled if none of the fans 
is running, and then delivers the signal state “O”. This is negated and assigned to 
the #Display.noFan tag. 


O #Fanl.running 

O #Fan2.running 

NOT //Negate RLO 

= #Display.noFan //No fan is running 


Fig. 9.10 Example of negation of result of logic operation 


Set and reset RLO 


The SET operation sets the result of logic operation to “1”. The CLR operation sets 
the result of logic operation to “0”. SET and CLR terminate an operation step (Fig. 
9.11). 


SET //Set RLO to “1” 

5 #Fanl.drive //Fan 1 is switched on 

R #Fan2.drive //Fan 2 is switched off 

CLR //Set RLO to “0” 

CD “Parts counter” //The internal edge trigger flag for 


//counting down is reset 


Fig. 9.11 Example of setting and resetting the result of logic operation 


9.3. Programming memory functions with STL 


The memory functions control binary tags such as outputs or bit memories. 
Memory functions exist for assigning, setting, and resetting a binary tag or for 
evaluating a change in signal state (Table 9.2). 


To program a memory function, enter the operation in a line followed by a space 
and then the operand; in the case of amemory function, enter a binary tag from the 
operand areas inputs, outputs, bit memories, data, and temporary local data. A bi- 
nary tag from the bit memory and data areas is ideal for the edge trigger flag. The 
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Table 9.2 Memory functions with STL 


Operation Operand Function 

= Binary tag Assignment of result of logic operation 

S Binary tag Set to signal state “1” with result of logic operation “1” 

R Binary tag Reset to signal state “O” with result of logic operation “1” 
FP Edge trigger flag Evaluation of a positive edge of result of logic operation 

FN Edge trigger flag Evaluation of a negative edge of result of logic operation 


program editor supports you during input of operands by displaying all suitable, 
previously programmed tags following input of the first character. 


In the same line you can enter a comment, separated by two slashes, up to the end 
of the line. 


9.3.1 Assignment 


The assignment directly assigns the result of logic operation to the binary tag 
named with the operation. The response of the assignment is described in Chapter 
12.2.2 “Standard coil, assignment” on page 469. 


In Fig. 9.12, the #Display.MinOneFan tag is set to signal state “1” if the operation is 
fulfilled and to signal state “0” if it is not fulfilled. The result of logic operation is 
negated by NOT and, together with a further statement, controls the #Display.noFan 
tag. 


O #Fanl.running 

O #Fan2.running 

= #Display.MinOneFan //At least one fan is running 
NOT //Negate RLO 

- #Display.noFan //No fan is running 


Fig. 9.12 Example of assignment of result of logic operation 


9.3.2 Setting and resetting 


The set or reset operation is used to assign signal state “1” or “O” to a binary tag in 
the case of a result of logic operation “1”. A result of logic operation “0” has no ef- 
fect. 


The response of these operations is described in Chapter 12.2.3 “Single setting and 
resetting” on page 469. 


In Fig. 9.13, an AND function comprising #Fan1.enable and #Fan1.start controls the 
set operation. #Fan1.drive is set to signal state “1” if the AND function is fulfilled, 
or there is no reaction if the AND function is not fulfilled. The reset operation is con- 
trolled by an OR function where an AND function with two inputs is connected to its 
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A Fanl.enable 

A Hanivystart 

s Fanl.drive //Switch on fan 1 
A Fanl.enable 

A Fanl.stop 

ON Fanl fault 

R Fanl.drive //Switch off fan 1 


Fig. 9.13 Example of set and reset operations 


first input. #Fan1.drive is reset to signal state “O” if the operation is fulfilled, or 
there is no reaction if the operation is not fulfilled. As a result of positioning of the 
reset operation after the set operation, the memory response is “reset dominant”: 
If the logic operations in front of the two operations have signal state “1”, 
#Fan1.drive is reset or remains reset. 


9.3.3 Edge evaluation 


Edge evaluation detects a change in the result of logic operation. 


The edge evaluation has the result of logic operation “1” for one processing cycle if 
the result of logic operation prior to the operation changes from “0” to “1” (FP op- 
eration, rising edge) or from “1” to “0” (FN operation, falling edge). This “pulse” can 
be linked further or control a conditional operation. 


The edge trigger flag is present next to the edge operation. This is a flag or data bit 
which saves the “old” signal state of the result of logic operation. The change in sig- 
nal is recognized by comparing the signal states of the “new” (current) result of 
logic operation and the edge trigger flag (see also Chapter 12.2.5 “Edge evaluation” 
on page 472). 


Fig. 9.14 shows an application of edge evaluation. Let us assume that a message has 
“arrived”, i.e. the #Alarm_bit signal changes to “1”. The #Alarm_memory tag is then 
set. The alarm memory can be reset using an #Acknowledge button. The alarm 
memory remains reset if #Acknowledge has the signal state “0” again and 
#Alarm_bit is still present. #Alarm_memory is only set again by a further positive 
edge of #Alarm_bit (if #Acknowledge then no longer has signal state “1”). 


A #Alarm bit 

FP #Alarm bit Edge trigger flag //Evaluation for positive edge 
#Alarm_ memory 

& #Acknowledge 

R #Alarm_memory 


Fig. 9.14 Example of edge evaluation with STL 
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9.4 Programming timer and counter functions 
with STL 


9.4.1 SIMATIC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
The SIMATIC timer functions are an operand area in the CPU's system memory and 
their number is limited. Table 9.3 shows the operations possible in conjunction 
with a timer operand. How the SIMATIC timer functions respond is described in de- 
tail in Chapter 12.3 “SIMATIC timer functions” on page 477. 


Table 9.3 Operations for SIMATIC timer operands 


Operation | Operand Function 

sP Timer operand | Start a SIMATIC timer function as pulse 

SE Timer operand | Start a SIMATIC timer function as extended pulse 

SD Timer operand | Start a SIMATIC timer function as ON delay 

ss Timer operand | Start a SIMATIC timer function as retentive ON delay 

SF Timer operand | Start a SIMATIC timer function as OFF delay 

FR Timer operand | Enabling a SIMATIC timer function 

R Timer operand | Resetting a SIMATIC timer function 

L Timer operand | Direct loading of a time value 

LC Timer operand | Coded loading of a time value 

A, AN Timer operand | Status scan of a SIMATIC timer function and linking according to AND 
O, ON Timer operand | Status scan of a SIMATIC timer function and linking according to OR 
X, XN Timer operand | Status scan of a SIMATIC timer function and linking according to exclusive OR 


For programming, enter the timer operation in a line or drag the corresponding 
symbol with the mouse from the program elements catalog under Basic instruc- 
tions > Basic instructions > Timer operations to the working area. The operation is 
followed by a space and then the time operand (T) to which you can assign a sym- 
bolic name in the PLC tag table. 


When programming a SIMATIC timer function you must make sure that the opera- 
tions are in the correct order: first enable, then start and reset, and finally load time 
value and scan status. In so doing, you only program the operations required for 
the function to be executed. 


When starting a SIMATIC timer function, the control processor obtains the defined 
duration from accumulator 1. When and how this value enters the accumulator is 
unimportant. In order to make your program easier to read, you should preferably 
load the duration into the accumulator directly prior to the start operation, either 
as a constant with direct specification of the duration in data format SSTIME or as 
a tag with the duration as content. Loading of a value into the accumulator is de- 
scribed in Chapter 13.2.3 “Loading and transferring with STL” on page 510. 


Note that a valid duration must also be present in accumulator 1 even if the timer 
function is not started when processing the start operation. 
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In Fig. 9.15, the time “Fan5.on_delay” is started as an ON delay by the positive edge 
of #Fan5.start. The duration of 3 seconds was previously loaded into the accumula- 
tor as the constant S5T#3S. Following expiry of the duration, the timer function 
“Fan5.off_ delay” is started with the duration present as a value in the 
#Follow-up_time tag. The status of the timer function “Fan.off_delay” simultaneous- 
ly has signal state “1” so that fan 5 is switched on following the ON delay. Once the 
start signal #Fan5.start has signal state “O”, fan 5 continues to run for the follow-up 


time and is then switched off. 


#Fan5.start 
L SST#3S 
SD Nitshals) (eid Clelleny/” 
A Nimehals), Om Cleiley/” 
L #Follow-up_ time 
SF Minha), Oi Clelleiy7” 
A Nineilsy, Oni Clee” 
= #Fan5.drive 


//Start as ON delay 


//Start as OFF delay 


//Scan status 


Fig. 9.15 Example of application of SIMATIC timer functions with STL 


Example of clock generator 


The somewhat more complex example in Fig. 9.16 shows a clock generator with a 
different pulse-to-pause ratio implemented by means of a single timer function. 
The JC statement Conditional jump is executed if the result of logic operation is “1”. 


AN #Start_input 

R “Timer function” 

R #Output 

we M1 

A “Timer function” 

JC M2 

AN #Output 

= #Output 

L #Pulse duration 

JC M2 

L #Pause duration 
M2: AN “Times fonction 

SE “Taner fanetion™ 
Miser //Further program 


#Start_input starts the clock generator. 


If the timer “Timer function” is not running 
or has expired, it is started as an extended 
pulse. 


The binary scaler #Output changes its sig- 
nal state with each (new) start of the timer 
and thus also determines the duration - 
#Pulse_duration or #Pause_duration - with 
which the timer is started. 


Fig. 9.16 Example of clock generator with different pulse-to-pause ratio 
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9.4.2 SIMATIC counter functions 


Counter functions are used to implement counting tasks in the user program. The 
SIMATIC counter functions are an operand area in the CPU's system memory and 
their number is limited. Table 9.4 shows the counter operations possible in con- 
junction with a counter operand. How a SIMATIC counter function responds is de- 
scribed in detail in Chapter 12.5 “SIMATIC counter functions” on page 495. 


Table 9.4 Operations for SIMATIC counter operands 


Operation | Operand Function 

CU Counter operand Increment a SIMATIC counter function by one unit 

cD Counter operand Decrement a SIMATIC counter function by one unit 

Ss Counter operand Set a SIMATIC counter function to a start value 

FR Counter operand Enabling a SIMATIC counter function 

Counter operand Resetting a SIMATIC counter function 

As Counter operand Direct loading of a count value 

LC Counter operand Coded loading of a count value 

A, AN Counter operand Status scan of a SIMATIC counter function and linking according to an 

O, ON Counter operand AND logic operation 

X, XN Counter operand Status scan of a SIMATIC counter function and linking according to OR 
Status scan of a SIMATIC counter function and linking according to an 
exclusive OR logic operation 


For programming, enter the counter operation in a line or drag the corresponding 
symbol with the mouse from the program elements catalog under Basic instruc- 
tions > Basic instructions > Counter operations in a line. The operation is followed by 
a space and then the counter operand (C) to which you can assign a symbolic name 
in the PLC tag table. 


When programming a SIMATIC counter function you must make sure that the op- 
erations are in the correct order: first enable, then count, set and reset, and finally 
load count value and scan status. In so doing, you only program the operations re- 
quired for the function to be executed. 


When setting a SIMATIC counter function, the control processor obtains the initial 
count value from accumulator 1. When and how this value enters the accumulator 
is unimportant. In order to make your program easier to read, you should prefera- 
bly load the initial count value into the accumulator directly prior to the set opera- 
tion, either as a constant with direct specification of the count value in data format 
W#16# or C# or as a tag with the count value as content. Loading of a value into the 
accumulator is described in Chapter 13.2.3 “Loading and transferring with STL’ on 
page 510. 


Note that a valid count value must also be present in accumulator 1 even if the 
counter function is not set when processing the set operation. 


Fig. 9.17 shows the counting of workpieces up to a specific quantity. The counter 
#Parts_counter is set by the #Quantity_set tag to a start value of 120. Each positive 
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A #Workpiece identified 
CD “Parts counter” //Count down 


#Quantity set 


L C#120 //Load default value 
“Parts counter” //Set counter to default value 
AN MIPBNCIES| Cowimiceie” //Scan status of counter 


= #Quantity reached 


Fig. 9.17 Example of application of a SIMATIC counter function with STL 


edge at the #Workpiece_identified tag decrements the count value by one unit. If a 
value of zero is reached - the counter status is then “O” - #Quantity_reached is set. 


9.4.3 IEC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
With a CPU 400, an IEC timer function is a system function block (SFB) in the oper- 
ating system and is called in the user program like a function block. A detailed de- 
scription of the IEC timer functions is provided in Chapter 12.4 “IEC timer func- 
tions” on page 491. 


For programming, drag the corresponding symbol (TP, TON, or TOF) with the 
mouse from the program elements catalog under Basic instructions > Timer opera- 
tions into a line on the working area. When positioning, you select either as single 
instance or as local instance. The instance data block generated automatically 
when selecting as a single instance is saved in the project tree under Program 
blocks > System blocks > Program resources. 


With the IEC timer functions, a binary tag must be connected to the IN input, and a 
duration to the PT input. You can also directly access the output parameters using 
the instance data, for example with “DB _name”.Q or “DB_name”.ET for a single in- 
stance. 


Fig. 9.18 shows the IEC timer function #MessageDelay, which saves its data as a local 
instance in the instance data block of the calling function block. If the #Measure- 
ment_too_high tag has a signal state “1” for longer than 10 s, #Message_too_high is 
set. 


CALL #MessageDelay //Start as ON delay 
Time 


IN := #Measurement_too high 


PT := T#10S //10 s duration 
Q := #Message too high 
ET := //ET is not required 


Fig. 9.18 Example of IEC timer function with STL 
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9.4.4 IEC counter functions 


Acounter function implements counting processes in the user program. With a CPU 
400, an IEC counter function is a system function block (SFB) in the operating sys- 
tem and is called in the user program like a function block. A detailed description 
of the IEC counter functions is provided in Chapter 12.6 “IEC counter functions” on 
page 502. 


For programming, drag the corresponding symbol (CTUD, CTU or CTD) with the 
mouse from the program elements catalog under Basic instructions > Counter oper- 
ations into a line on the working area. When positioning, you select either as single 
instance or as local instance. The instance data block generated automatically when 
selecting as a single instance is saved in the project tree under Program blocks > Sys- 
tem blocks > Program resources. 


With the IEC counter functions, a binary tag must be connected to at least one 
counter input (CU or CD). Connection of the other function inputs and outputs is 
optional. You can also directly access the output parameters using the instance 
data, for example with “DB_name”.QD or “DB_name’”.CV for a single instance. 


Fig. 9.19 shows the IEC counter function #Lock_counter, which is called as a local 
instance. It has saved its data in the instance data block of the calling function block. 
A component of the counter can be addressed globally with the name of the 
instance and the component name, for example #Lock_counter.CV. The example 
shows the passages through a lock, either forward or backward. 


A Nibuliepelic Joysaere alee 2 

FP Nibab@jlae Jeyericieiteie2 Mielefe: (eicilfejeieue in Jeter“ 

A ibuligpotc Jeysiaere alee LY 

= #temp_booll //Count up 
A “Light_barrier1” 

FP Mawel Iseviowsleiell Wickets, wieilejeieue ir lee” 


A Nibal(eponc. Joyelaere skies ZV 
= #temp_bool2 //Count down 
CALL #Lock counter //Start as 
Int //Up/down counter 
CU := #temp_booll 
CD := #temp_bool2 
R := #Acknowledge 


Fig. 9.19 Example of IEC counter function with STL 
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9.5 Programming digital functions with STL 


The digital functions process digital values mainly with the data types INT, DINT, 
and REAL. With a CPU 400, processing takes place in four registers of the control 
processor, the so-called accumulators. These are 32-bit wide memory locations 
which are addressed by the digital functions and special statements. 


Accumulator assignment with digital functions 


Accumulator assignment before executing the examples 


<Accumulator 1> <Accumulator 2> <Accumulator 3> <Accumulator 4> 


Digital function with one parameter 


Program Accumulator assignment following execution of instruction 
@® L_ #Input value Input value <Accumulator 1> <Accumulator 3> <Accumulator 4> 
Function Result <Accumulator 1> <Accumulator 3> <Accumulator 4> 
T  #Result Result <Accumulator 1> <Accumulator 3> <Accumulator 4> 


The load function writes the input value into Accumulator 1. Accumulator 2 is overwritten with the previous 
content of Accumulator 1. 

A digital function with an input value changes only the contents of Accumulator 1. This can also occur several 
times in succession. Example: First, calculation of the square with the function SQR and subsequent data type 
conversion from REAL to DINT with the RND function. 

The transfer function transfers the contents of Accumulator 1 to the tags specified in the transfer function. 
The contents of Accumulators 2 to 4 are not changed. 


© Oo © ®& 


© 


Digital function with two parameters 


Program Accumulator assignment following execution of instruction 
@® L  #Input value1 Inputvalue1  <Accumulator1> <Accumulator 3> <Accumulator 4> 
@ L_ #Input value2 Input value2 Inputvalue1 <Accumulator 3> <Accumulator 4> 
@ Function Result (see text) (see text) <Accumulator 4> 
@ T #Result Result (see text) (see text) <Accumulator 4> 


@ _ The load function writes the input value into Accumulator 1. Accumulator 2 is overwritten with the previous 
content of Accumulator 1. 


The load function writes the second input value into Accumulator 1. The first input value which was 
previously in Accumulator 1 is shifted to Accumulator 2. 


© A digital function with two parameters links the contents of Accumulators 1 and 2 according to the schema 
<Accumulator 2> Function <Accumulator 1> 
and writes the result into Accumulator 1. 
A shift function and word logic operation that use Accumulator 2 do not change the contents of Accumulator 2. 
An arithmetic function overwrites Accumulator 2 with the contents of Accumulator 3, and then overwrites 
Accumulator 3 with the contents of Accumulator 4. 


@ The transfer function transfers the contents of Accumulator 1 to the tags specified in the transfer function. 
The contents of Accumulators 2 to 4 are not changed. 


Fig. 9.20 Accumulator assignment with digital operations 
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Accumulators 1 and 2 are sufficient to execute a digital function. They are supplied 
with numerical values with the load function (L); the digital function manipulates 
these values and the transfer function (T) transmits the result back to the user or 
system memory (Fig. 9.20). 


Accumulators 3 and 4 can serve as a buffer for digital functions which are executed 
sequentially multiple times. The accumulator functions are available for reading 
and writing to these accumulators. 


9.5.1 Transfer functions 


The transfer functions copy the value of a tag. 


The Load operation transfers a digital value from the CPU's memory area into accu- 
mulator 1. The Transfer operation transfers a digital value from accumulator 1 to 
the memory area. A detailed description of the transfer functions is provided in 
Chapter 13.2.3 “Loading and transferring with STL” on page 510. Table 9.5 shows 
the transfer functions available with STL. 


Table 9.5 Transfer functions with STL 


Operation | Operand Function 


L Digital tag from the operand areas: peripheral inputs, Transfer to accumulator 1 
peripheral outputs, inputs, outputs, bit memories, data, 
and temporary local data 


L SIMATIC timer function, SIMATIC counter function Direct loading into accumulator 1 
LC SIMATIC timer function, SIMATIC counter function Coded loading into accumulator 1 
T Digital tag from the operand areas: peripheral inputs, Transfer from accumulator 1 


peripheral outputs, inputs, outputs, bit memories, data, 
and temporary local data 


The program elements catalog contains the transfer functions under Basic instruc- 
tions > Basic instructions > Load and transfer. 


Fig. 9.21 shows an example of loading and transferring: The #Messages tag is trans- 
ferred from the data block “Data.STL” to the “Message_bits” tag in the bit memory 
address area. 


L “Data.STL” .Messages //Load value into accumulator 1 
ely “Message bits” //Fetch value from accumulator 1 


Fig. 9.21 Example of load and transfer statements 


9.5.2 Comparison functions 


The comparison functions compare the contents of accumulators 1 and 2, and the 
result of the comparison is assigned to the result of logic operation. The result of 
logic operation has signal state “1” if the comparison is fulfilled, otherwise “0”. The 
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comparison function is described in Chapter 13.3 “Comparison functions” on page 
518. Table 9.6 shows the comparison functions available with STL. 


Table 9.6 Comparison functions with STL 


Operation | Operand | Function Operation | Operand | Function 
Comparison for Comparison for 

=| - Equal to according ==D - Equal to according to DINT 
to INT 

<> Not equal to according | <>D Not equal to according 
to INT to DINT 

>I Greater than according | >D Greater than according 
to INT to DINT 

>=l Greater than or equalto | >=D Greater than or equal to 
according to INT according to DINT 

<l Less than according <D Less than according to DINT 
to INT 

<sl Less than or equal to <=D Less than or equal to 
according to INT according to DINT 

Comparison for Comparison for 

==R - Equal to according >=R - Greater than or equal to 
to REAL according to REAL 

<>R Not equal to according | <R Less than according to REAL 
to REAL 

>R Greater than according | <=R Less than or equal to 
to REAL according to REAL 


The program elements catalog contains the comparison functions under Basic 
instructions > Basic instructions > Comparator operations. 


General execution of a comparison function 


You program a comparison function according to the following general schema: 


L Tagl The tags are compared according to the schema 
L Tag2 Tag1 (compare) Tag2. 
Comparison function 


= Result of comparison 


A comparison function does not change the accumulator contents. It is always car- 
ried out independent of conditions. A comparison function sets the status bits. 


Comparison function in a logic operation 

The comparison function delivers a binary result of logic operation and can there- 
fore be used together with other binary functions. The comparison function sets 
the status bit /FC, i.e. an operation step commences with the comparison function. 


At the beginning of a logic operation, a comparison function is always a first input 
bit scan. The RLO delivered by the comparison function can be directly further 
linked with binary scans. 
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L 
L 


A 


Tagl Output! is set in the example if the comparison 

Tag2 is fulfilled and Input1 has signal state “1”. 
Comparison function 

Inputl 

Outputl 


A comparison function within a binary logic operation must be set within parenthe- 
ses since a new operation step is started with the comparison function (first input 


bit scan). 
O nput2 Output? is set in the example if Input2 or Input3 
0 ( has signal state “1” or if the comparison is ful- 
L Tagl filled. 
L Tag2 


Comparison function 


) 
O 


nput3 
Output2 


Since a comparison function does not change the accumulator contents, it is possi- 
ble in STL to repeatedly carry out successive comparisons. 


Tagl In the example, two comparison functions are 
Tag2 applied to the same accumulator contents. 
The first comparison generates RLO = “1” if 
Greater than Tag1 is greater than Tag2 so that the jump to 
the Greater than label is carried out. The second 
Equal to comparison for equal to is then carried out 


without reloading the accumulators and gener- 
ates anew RLO. 


The comparison function sets the status bits depending on the relationship 
between the compared values, i.e. independent of the comparison operation spec- 
ified. You can utilize this fact by scanning the status bits with the corresponding 
jump functions. The example shown above can also be programmed as follows: 


JP 
JZ 


Tagl In this example, evaluation of the comparison 
Tag2 is carried out using the status bits CCO and 
CC1. The comparison relationship - “Greater 
Greater than than” in this case - is of no importance when 
Equal to setting the status bits, one could also have 


used a different relationship, e.g. “Less than”. 
JP scans whether the first comparison value is 
greater than the second one, JZ scans whether 
they are equal. 
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Two comparison functions are programmed in Fig. 9.22. For the first comparison, 
the #Measurement_temperature and #Lower_limit tabs are loaded into the accumu- 
lators. The comparison function then compares the first value 4Measurement_tem- 
perature (in accumulator 2) with the second value #Lower_limit (in accumulator 1) 
for greater than or equal to in data format INT. The result of the comparison is 
saved during processing of the operation “A(”. The second comparison is carried 
out with the #Measurement_temperature and #Upper_limit tags. Its comparison re- 
sult is linked with the saved comparison result according to an AND logic operation. 


L Measurement temperature 

L Lower limit 

S=I //Comparison with lower limit 

A( //Save comparison result 1 

L Measurement temperature 

L Upper limit 

Pout //Comparison with upper limit 

) //Comparison results 1 and 2 

= Measurement_in_ range //Link according to AND logic operation 


Fig. 9.22 Example of comparison function with STL 


If both comparisons are fulfilled, i.e. if the #Measurement_temperature tag is be- 
tween #Lower_limit and #Upper_limit, then #Measurement_in_range is set. 


9.5.3 Arithmetic functions 


The arithmetic functions for numerical values implement the basic arithmetical 
operations with the data formats INT, DINT, and REAL in the user program. 


An arithmetic function calculates a result from the values present in the accumu- 
lators 1 and 2 and stores it in accumulator 1. A detailed description of these arith- 
metic functions is provided in Chapter 13.4 “Arithmetic functions” on page 521. 
Table 9.7 shows the arithmetic functions available with STL. 


Table 9.7 Arithmetic functions with STL 


Operation | Operand | Function Operation | Operand | Function 

+l - Addition according to INT +D - Addition according to DINT 
-l Subtraction according to INT | —D Subtraction according to 
*| Multiplication according to DINT 

INT *D Multiplication according to 
i Division according to INT DINT 

ID Division according to DINT 

+R - Addition according to REAL MOD - Division according to DINT 
-R Subtraction according to with remainder as result 

REAL 
*R Multiplication according to 

REAL 
IR Division according to REAL 
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The program elements catalog contains the arithmetic functions under Basic 
instructions > Basic instructions > Math functions. 


You program an arithmetic function for two digital tags according to the following 
general schema: 


L Tagl The first operand to be linked is initially loaded 
L Tag2 into accumulator 1. When loading the second 
Arithmetic function operand, the content of accumulator 1 is shift- 
T Result of calculation ed into accumulator 2. The contents of the ac- 


cumulators 2 and 1 can then be linked using 
the arithmetic function. The result is stored in 
accumulator 1. 


An arithmetic function carries out the calculation according to the specified char- 
acteristic independent of the contents of the accumulators and independent of con- 
ditions. 


Assignment of accumulator 2 


After an arithmetic function is executed, accumulator 2 is overwritten with the con- 
tent of accumulator 3 (Fig. 9.23). In connection with the accumulator functions, ac- 
cumulators 3 and 4 can be used in this way as buffer in chain calculations. Examples 
are provided in Chapter 9.7.1 “Accumulator functions” on page 390. 


Accumulator assignment with arithmetic functions 


Accumulator assignment before executing of arithmetic function 


<Input value 1> <Input value 2> <Accumulator 3> <Accumulator 4> 


Accumulator assignment following execution of arithmetic function 


<Result> <Accumulator 3> <Accumulator 4> <Accumulator 4> 


Fig. 9.23 Accumulator assignment with arithmetic functions 


Special features when calculating with data type INT 


The left words of the accumulators are not taken into consideration when adding 
and subtracting. The result leaves the last word of accumulator 1 unchanged. 


The left words of the accumulators are not taken into consideration when multiply- 
ing (*I). Following execution of the *I function, the product is present as a DINT 
number in accumulator 1. 


The /I function interprets the values present in the right words of accumulators 1 
and 2 as numbers with data type INT. It divides the value in accumulator 2 (dividend) 
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by the value in accumulator 1 (divisor) and delivers two results: the quotient and the 
remainder, both numbers with data type INT (Fig. 9.24). 


Arithmetic functions, integer division 


Program Accumulator assignment following execution of instruction 
Accumulator 1 Accumulator 2 
Shs 16 WS, oe aes ee wil 6 15... 20 
L valuel 0 Value 1 (dividend) <Accumulator 1> 
L value2 0 Value 2 (divisor) 0 Value 1 (dividend) 
/1 Remainder Quotient <Accumulator 3> 
T result Remainder Quotient <Accumulator 3> 
The contents of the right word in accumulator 2 (value 1) are divided by the contents of the right 
word in accumulator 1 (value 2). The integer result of the division is stored in the right word of 
accumulator 1, the remainder of the division is present in the left word of accumulator 1. 


Fig. 9.24 Result of arithmetic function /I 


Following execution of the function, the quotient is present in the right word of ac- 
cumulator 1. It is the integer result of the division. The quotient is zero if the divi- 
dend is equal to zero and the divisor not equal to zero, or if the magnitude of the 
dividend is smaller than the magnitude of the divisor. The quotient is negative if 
the divisor was negative. Following /I, the leftover remainder of the division (not the 
decimal places!) is present in the left word. With a negative dividend, the remainder 
is also negative. 


Following execution of the calculation, the status bits CCO and CC1 indicate whether 
the quotient is negative, zero, or positive. The status bits OV and OS signal that the 
permissible numerical range has been left. A division by zero (/I, /D, MOD) delivers a 
value of zero in each case as quotient and remainder and sets the status bits CCO, 
CC1, OV, and OS to “1”. 


Successive arithmetic functions 


You can permit an arithmetic function to directly follow a previous arithmetic func- 
tion (chain calculation). The result of the first function is then linked further by 
means of the next function and the accumulators serve as intermediate memories. 


Th Valuel Result! := Valuel + Value2 - Value3 
L Value2 

+1 

L Value3 

-I 

alk Resultl 
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Example 


In Fig. 9.25, the upper limit of a measured value is monitored. A hysteresis is intro- 
duced to ensure that the #Measurement_too_high message does not “pulsate” when 
the measured value changes rapidly around the upper limit. The message #Mea- 
surement_too_high is only canceled when the measured value has dropped again 
below the upper limit by the magnitude of the hysteresis. 


L Measurement temperature 


L Upper limit 


Measurement_too_high 


L Upper limit 

L Hysteresis 

al //Subtraction with the 
L Measurement_temperature //data format INT 

>I 

R Measurement_too_high 


Fig. 9.25 Example of arithmetic function with STL 


9.5.4 Math functions 


You can use the mathematical functions, for example, to implement trigonometric 
functions, exponential functions, and logarithmic functions with tags in data for- 
mat REAL. 


A mathematical function calculates a result from the value present in accumulator 1 
and saves it in accumulator 1. A detailed description of these math functions is pro- 
vided in Chapter 13.5 “Math functions” on page 527. Table 9.8 shows the mathemat- 
ical functions available with STL. 


The program elements catalog contains the arithmetic functions under Basic 
instructions > Basic instructions > Math functions. 


Fig. 9.26 shows the calculation of the reactive power according to the equation 
#Reactive_power = #Voltage x #Current x sin(#phi). The #Voltage and #Current tags 
are initially loaded and multiplied according to REAL. The #phi value is then loaded; 
the product of #Voltage and #Current is now present in accumulator 2. The sine of 


Table 9.8 Mathematical functions with STL 

Operation | Operand | Function Operation | Operand Function 

SIN - Calculate sine ASIN - Calculate arcsine 

cos Calculate cosine ACOS Calculate arccosine 

TAN Calculate tangent ATAN Calculate arctangent 

SQR = Generate square EXP = Generate exponential func- 
tion to base e 

SQRT Extract square root LN Generate Napierian loga- 
rithm (to base e) 
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L Voltage 

L, Current 

IRL //Multiplication according to REAL 
L phi 

SIN //Calculate sine 

PIR //Multiplication according to REAL 
Ty Reactive power //Save result 


Fig. 9.26 Example of mathematical functions with STL 


generated from the value #phi. The product of #Voltage and #Current present in ac- 
cumulator 2 is multiplied by the sine of #phi present in accumulator 1 by means of 
the subsequent operation *R, the result saved in accumulator 1, and then trans- 
ferred to the #Reactive_power tag. 


9.5.5 Conversion functions 


The conversion functions convert the data formats of tags. 
Aconversion function converts the value present in accumulator 1 and saves the re- 
sult in accumulator 1. A detailed description of the conversion functions is provid- 


ed in Chapter 13.6 “Conversion functions” on page 531. Table 9.9 shows the conver- 
sion functions available with STL. 


Table 9.9 Conversion functions with STL 


Operation | Operand Function 
ITD = Data type conversion from INT to DINT 
ITB Data type conversion from INT to BCD 
DTB Data type conversion from DINT to BCD 
DTR Data type conversion from DINT to REAL 
BTI - Data type conversion from BCD to INT 
BTD Data type conversion from BCD to DINT 
Data type conversion from REAL to DINT 
RND+ - With rounding to the next higher number 
RND- With rounding to the next lower number 
RND With rounding to the next integer 
TRUNC Without rounding 
INVI - Generation of the one's complement for INT 
INVD Generation of the one's complement for DINT 
NEGI Generation of the two's complement (negation) of an INT number 
NEGD Generation of the two's complement (negation) of a DINT number 
NEGR Negation of a REAL number 
ABS Generation of magnitude of a REAL number 


General processing of conversion functions 


The conversion functions are only effective on accumulator 1. Depending on the 
function, either only the right word (bits 0 to 15) or the complete contents are af- 
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fected by this. The conversion functions do not change the contents of the remain- 
ing accumulators. You program a conversion function according to the following 
general schema: 


L Tag 
Conversion function 
T Result 


A conversion function is carried out according to the defined characteristic even if 
no data types have been declared when using absolutely addressed operands. A 
conversion function is carried out independent of conditions. 


Successive conversion functions 


You can subject the content of accumulator 1 to several successive conversions and 
thus carry out conversions in several steps without having to save the converted 
values in intermediate memory (Fig. 9.27). 


The program elements catalog contains the arithmetic functions under Basic 
instructions > Basic instructions > Conversion operations. 


Fig. 9.27 shows an example of the conversion functions. A measured value present 
in data format INT is first expanded to the data format DINT and then converted in- 
to the BCD format. 


L #Measurement_temperature 

TWD) //Conversion INT to DINT 
DTB //Conversion DINT to BCD32 
ua #Measurement_display 


Fig. 9.27 Example of conversion functions with STL 


9.5.6 Shift functions 


With the shift functions you can shift the content of tags bit-by-bit to the left or 
right. 


A shift function shifts the value present in accumulator 1 by so many bit positions 
to the left or right as specified in accumulator 2 or as a parameter. A detailed 
description of the shift functions is provided in Chapter 13.7 “Shift functions” on 
page 544. Table 9.10 shows the shift functions available with STL. 


The shift functions are carried out independent of conditions. They only change the 
content of accumulator 1. The result of logic operation (RLO) is not influenced. You 
can program a shift function in two different ways: 


> With the shift number in L Shift number 
accumulator 2 L Input tag 
Shift function 
an Result 
> With the shift number as it Input tag 
parameter Shift function + shift number 
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Table 9.10 Shift functions with STL 


Operation Operand | Function 
Shift word-by-word 

SLW n To left with shift number as parameter 

SLW To left with shift number in accumulator 2 

SRW n To right with shift number as parameter 

SRW To right with shift number in accumulator 2 

ss n With sign to right with shift number as parameter 

ss With sign to right with shift number in accumulator 2 
Shift doubleword-by-doubleword 

SLD n To left with shift number as parameter 

SLD To left with shift number in accumulator 2 

SRD n To right with shift number as parameter 

SRD To right with shift number in accumulator 2 

SSD n With sign to right with shift number as parameter 

SSD With sign to right with shift number in accumulator 2 
Doubleword rotation 

RLD n To left with shift number as parameter 

RLD To left with shift number in accumulator 2 

RRD n To right with shift number as parameter 

RRD To right with shift number in accumulator 2 

RLDA - Doubleword rotation by one position to left by the condition code bit CC1 

RRDA Doubleword rotation by one position to right by the condition code bit CC1 


The shift functions set status bit CCO to “0” and status bit CC1 to the signal state of 
the last bit shifted out. 


Successive shift functions 


Shift functions can be applied as often as desired to the content of the accumulator. 
Example: 


L Value In the example shifting is carried out with the 
ssD 4 correct sign by (in the end) 2 positions to the 
SLD 2 right, where the two right bit positions are 

T Result reset to signal state “0”. 


The program elements catalog contains the shift functions under Basic instruc- 
tions > Basic instructions > Shift and rotate. 


In Fig. 9.28, the decades of two numbers present in BCD format of a SIMATIC 
counter are joined. In the top program the shift number 16 is loaded first and then 
with #Quantity_high the tag to be shifted. SLD shifts the content of the complete 
accumulator 1 by 16 (the shift number in accumulator 2). The subsequently loaded 
#Quantity_low tag is shifted by 4 bits to the left and linked according to an OR logic 
operation to the result of the previous shift. The six decades which are now present 
without gaps are shifted by a further 4 bits to the right and saved. The solution in 
the bottom program is somewhat shorter: The #Quantity_high tag is shifted to the 
left by three decades. The space which becomes vacant is occupied by the #Quanti- 
ty_low tag. 
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L 6 

L Quantity high 

SLD //Shift with shift number in accumulator 2 
L Quantity low 

SLW 4 //Shift word-by-word to left 

OD 

SRD 4 //Shift doubleword-by-doubleword to right 
zy Quantity display 

L Quantity high //Shorter program 

SLD 2 //Shift doubleword-by-doubleword to left 
L Quantity low 

OD 

ay Quantity display 


Fig. 9.28 Example of shift functions with STL 


9.5.7 Word logic operations 


The word logic operations link the individual bits of two tags according to AND, OR, 
or exclusive-OR. 


A word logic operation links the values present in accumulators 1 and 2 in stores 
the result in accumulator 1. A detailed description of the word logic operations is 


Table 9.11 Word logic operations with STL 

Operation | Operand Function 

AW W#16#xxxx Word-by-word AND logic operation with the parameter 

AW Word-by-word AND logic operation with the content of accumulator 2 

AD DW#1 6#xxxx_xxxx | Doubleword-by-doubleword AND logic operation with the parameter 

AD Doubleword-by-doubleword AND logic operation with the content of 
accumulator 2 

ow W#1 6#Xxxx Word-by-word OR logic operation with the parameter 

Ow Word-by-word OR logic operation with the content of accumulator 2 

OD DW#1 6#xxxx_xxxx | Doubleword-by-doubleword OR logic operation with the parameter 

OD Doubleword-by-doubleword OR logic operation with the content of 
accumulator 2 

XOW W#16#xxxx Word-by-word exclusive OR logic operation with the parameter 

XOW Word-by-word exclusive OR logic operation with the content of accumulator 2 

XOD DW#1 6#xxxx_xxxx | Doubleword-by-doubleword exclusive OR logic operation with the parameter 

XOD Doubleword-by-doubleword exclusive OR logic operation with the content of 


accumulator 2 


provided in Chapter 13.8.1 “Word logic operations” on page 549. Table 9.11 shows 
the word logic operations available with STL. 
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Processing of a word logic operation 


The word logic operations are carried out independent of conditions. The result of 
logic operation (RLO) is not affected. You can program a word logic operation in two 
different ways: 


> Linking with a value in accumulator 2 L Tagl 
L Tag2 
Word logic operation 
T Result 
> Linking with the parameter (constant) L Tag 
Word logic operation + constant 
T Result 


Word-by-word operation 


The 16-bit word logic operations only act on the right word (bits 0 to 15) of the ac- 
cumulators. The left word (bits 16 to 31) remains unaffected (Fig. 9.29). 


16-bit logical operation 


Program Accumulator assignment following execution of instruction 
Accumulator 1 Accumulator 2 
BL, 16 15... iO BI. sl6. 1526 oa) 
L %MD160 %MW160 %MW162 <Accumulator 2> 
L %MD164 %MW 164 %MW166 %MW160 %MW162 
AW %MW164 MW 162 & %MW166 %oMW160 %oMW 162 
T %MD170 (%MW170) (%MW172) %MW160 %MW162 


A 16-bit logical (AW, OW, XOW) only uses the right word. In the example, the value of the bit memory 
doubleword (%MW164) is present in the left word of the result (Y%YMW170), and the ANDing of %MW162 
and %MW166 in the right word (%MD172). 

A 16-bit logical operation with a constatnt only gates the right word of accumulator 1 with the constant, 
and writes the result in the right word of accumulator 1. 


Fig. 9.29 Execution of a 16-bit word logic operation 


Successive word logic operations 


Following execution of a word logic operation you can directly connect the next 
word logic operation (load operand and execute word logic operation or execute 
word logic operation with constant) without having to save the intermediate result 
in an operand (e.g. local data). The accumulators serve here as intermediate mem- 
ories. 
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Examples: 

L Valuel The result of the AW operation is present in ac- 
L Value2 cumulator 1 and is shifted into accumulator 2 
AW upon loading of Value3. The two values can 
L Value3 then be linked according to OW. 

ow 

T Resultl 

L Value4 The result of the XOW operation is present in 
L Value5 accumulator 1. Its bits 0 to 3 are set to “0” by 
Xow the AW statement. 

AW 16#FFFO 

Result2 


The program elements catalog contains the word logic operations under Basic 
instructions > Basic instructions > Word logic operations. 


Fig. 9.30 shows how you can program 32 edge evaluations simultaneously for ris- 
ing and falling edges. The message bits are collected in a doubleword Messages, 
which is present in the data block “Data.STL”. The edge trigger flags Messages_EM 
are also present in this data block. If the two doublewords are linked by an XOR logic 
operation, the result is a doubleword in which each set bit represents a different as- 
signment of Messages and Messages_EM, in other words: the associated message bit 
has changed. 


In order to obtain the positive signal edges, the changes are linked to the messages 
by an AND logic operation. The bit is set for a rising signal edge wherever the mes- 
sage and the change each have a “1”. This corresponds to the pulse flag of the edge 


L “Data.STL” .Messages 

L NiDeioel Sb” Wessels. In) 

XOD //What bits have changed? 
#Messages change 

L, #Messages change 

L “Data.STL” .Messages 

AD //What change was a positive edge? 


“Data.STL”.Messages pos 


L, #Messages_ change 
L “Data.STL” .Messages 
NVD //Invert message bits 
AD //What change was a negative edge? 


“Data.STL” .Messages neg 


L “Data.STL” .Messages 


“Data.STL”.Messages EM //Update edge trigger flag 


Fig. 9.30 Example of word logic operations with STL 


379 


9 Statement list STL 


evaluation. If you do the same with the negated message bits - the message bits 
with signal state “O” are now “1” - you obtain the pulse flags for a falling edge. 


At the end it is only necessary for the edge trigger flags to track the messages. 


9.6 Controlling the program flow with STL 


You can influence processing of the user program by means of the program flow con- 
trol functions. Using status bits you can recognize errors during the execution of dig- 
ital functions, with the jump functions you can implement program branches, the 
block functions enable calling and termination of blocks, and the Master Control Re- 
lay enables influencing of output functions in complete program components. 


9.6.1 Working with status bits in the statement list 


Scanning status bits 


The control processor saves internal statuses in the status bits during program ex- 
ecution. These statuses can be scanned using scan operations and jump functions. 
A detailed description of the status bits is provided in Chapter 14.1 “Status bits” on 
page 561. Table 9.12 shows the available scan operations. 


The program elements catalog contains the scan operations under Basic instruc- 
tions > Basic instructions > Bit logic operations. 


Example: In Fig. 9.31, a floating-point number is checked for validity. To do this, the 
tag is compared with any floating-point constant. The type of comparison does not 
play arole here. The status bit UO (invalid) is set if the floating-point number is in- 
valid. The intermediate memory #Floating_point_number_invalid is set when this 
status bit is scanned and aJC jump is made to the Error label. 


Table 9.12 Scan operations for status bits with STL 


Operation Operand | Function 


A Scan for fulfilled condition and link according to AND logic operation 
(0) - Scan for fulfilled condition and link according to OR logic operation 
X Scan for fulfilled condition and link according to OR logic operation 


AN - Scan for non-fulfilled condition and link according to AND logic operation 
ON - Scan for non-fulfilled condition and link according to OR logic operation 
XN - Scan for non-fulfilled condition and link according to OR logic operation 

>0 Result greater than zero 

>=0 Result greater than or equal to zero 

<0 Result less than zero 

<=0 Result less than or equal to zero 

<>0 Result not equal to zero 

—_ Result equal to zero 


UO Result invalid (unordered) 
OV Overflow 

Os Retentive overflow 

BR Binary result 
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#Floating-point number 
WO) 


A UO Scan for “Result invalid” 
= #Floating point number invalid 
JC Error 


Fig. 9.31 Example of scanning a status bit with STL 


The status bits can also be scanned when loading the status word and the status bits 
are set when transferring the status word. 


References to evaluation of a numerical range overflow 


If the result of a calculation is outside the numerical range defined for the data type, 
it sets the status bit OV (overflow) and parallel to this the status bit OS (stored over- 
flow). 


If the result of a subsequent function is within the permissible numerical range, 
e.g. with a chain calculation, the status bit OV is reset. However, the status bit OS 
remains set so that a result overflow within a chain calculation is also recognized at 
the end of the calculation. OS is only reset by a jump function JOS or a change in 
block (call or block end). An example is shown in Fig. 9.32. 


//Binary scans //Jamp functions Following the first and 
L Valuel L Valuel second additions, an eval- 
L Value2 L Value2 uation is carried out for 
+I +1 overflow. This evaluation 
A OV JO label ST1 of the overflow status bit 
= Statusl only comprises the imme- 
L Value3 L Value3 diately preceding arith- 
+I +1 metic function. 
A OV JO Label ST2 P 
ad The overflow status bit OS 
= Status2 
saves a number overflow 
L, Value4 L, Value4 
é : for the complete calcula- 
tion. 
A OS JOS Label ST 
= #Group status 
#Result T #Result 


Fig. 9.32 Example of overflow evaluation 


Save binary result 


You can use the SAVE statement to save the result of logic operation in the binary 
result. The jump functions JCB and JNB also influence the binary result. A detailed 
description of SAVE is provided in Chapter 14.1.4 “Controlling the binary result” on 
page 565. 
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The program elements catalog contains SAVE under Basic instructions > Basic 
instructions > Bit logic operations. 


Note that SAVE does not set the status bit /FC to “O”. This means that a binary logic 
operation cannot be aborted by SAVE. SAVE is used to save the current result of logic 
operation without influencing the logic operation. 


The binary result can be used as a group error message, for example. Fig. 9.33 
shows an example of the collection of error messages in the last network of a block. 
The network is accessed via the Error jump label. In the event of an error message 
(#Floating point_number_invalid with “1” and #Adder_error with “0”), the binary re- 
sult BR if set to “O” before the block is left. The signal state of BR is transferred to the 
ENO output of this block. 


Error : AN #Floating_point_number invalid //Error with “1” 
A #Adder_error //Error with “0” 
SAVE //Reset BR with error 
BE //Block is left 


Fig. 9.33 Example of setting of BR with SAVE 


9.6.2, EN/ENO mechanism with STL 


The EN/ENO mechanism with LAD, FBD, and SCL uses the enable input EN and en- 
able output ENO. These sequences of statements represented as implicitly defined 
block parameters are not present with STL. However, you can program a group 
error message via the binary result BR and link block calls to each other. 


Using BR as error message 


If you program a block with STL which you wish to call in LAD, FBD or SCL, you 
should pay attention to the “correct” connection of the ENO output: The block is to 
be left with BR = “1” if no errors have occurred, and with BR = “O” if the processing 
was faulty. 


Example: BR is set at the start of the block to “1”. If an error then occurs during 
block processing, e.g. a result exceeds a defined range, and therefore further pro- 
cessing should be stopped, use JNB to set the binary result to “0” and jump e.g. to 
the block end (in the case of an error, the condition must deliver signal state “0” 
here). 


SET 

SAVE //BR = “1” 

L 10.000 

L #Result //If result > 10_000 

<=I 

JNB Error //Then BR = “0” and jump to error 
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The following sequence of statements sets BR to “0” in the event of a numerical 
range overflow: 


L #Number1 

L #Number2 

ll 

T #Total 

AN OV //Scan for numerical range overflow 
SAVE //With overflow: BR = “0” 


The following programming is suitable if processing is to be aborted when an error 
is detected and a jump should be made to a program section with error evaluation: 


L #Number1 

L #Number2 

+1 

T #Total 

AN OV //Scan for numerical range overflow 

JNB Error //With overflow: BR = “0” and jump to error 


Note that the jump functions JCB and JNB update the binary result according to the 
result of logic operation, even if the jump condition is not fulfilled. If you wish to 
use BR as a group error message in the block, you may only reset BR to “O” in the 
event of an error; BR must not be influenced if no errors are present. 


In the case of a block which uses the enable output ENO as an error display, the bi- 
nary result is set corresponding to the enable output ENO subsequent to the call 
statement and can be used further. 


CALL “Adder.STL” 


Numberl := “Data.STL”.Number[1] 

Number2 := “Data.STL”.Number [2] 

Number3 := “Data.STL”.Number [3] 

Total := “Data.STL”.Result[1] 
JNB Error //Jamp with error in block 
Track enable input EN 


You can track the enable input EN with STL using a jump function. If the condition 
is not fulfilled, a jump is carried out beyond the block call, and the block is not pro- 
cessed: 


ON #Call //If #Call is not fulfilled 
ON BR //or BR signals an error with “0” 
JC MOO1 //the block is not processed 
CALL “Adder.STL” 
Numberl := “Data.STL”.Number[1] 
Number2 := “Data.STL”.Number [2] 
Number3 := “Data.STL”.Number [3] 
Total := “Data.STL”.Result[1] 


MOO1: NOP 0 
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9.6.3 Jump functions 


You use jump functions to exit linear program execution and continue at a different 
point in the block. 


A detailed description of the jump functions is provided in Chapter 14.2 “Jump 
functions” on page 568. Table 9.13 shows the jump functions available with STL. 


Table 9.13 Jump functions with STL 


Operation | Operand | Function 

JU Label Jump absolute 

JC Label Jump if RLO ="1" 

JCN Label Jump if RLO v 

JCB Label Jump if RLO “and save RLO in BR 
JNB Label Jump if RLO =“0" and save RLO in BR 
JBI Label Jump if BR="1" 

JBIN Label Jump if BR =“0" 

JZ Label Jump if result equal to zero 

JN Label Jump if result not equal to zero 

JP Label Jump if result greater than zero 

JPZ Label Jump if result greater than or equal to zero 
JM Label Jump if result less than zero 

JMZ Label Jump if result less than or equal to zero 
JUO Label Jump if result invalid 

JO Label Jump if overflow 

JOS Label Jump if stored overflow 

JL Label Jump list 

LOOP Label Loop jump 


General information 


With STL the jump function consists of the jump operation and the jump destination 
(jump label). The jump operation specifies the condition under which the jump is 
carried out, the jump destination specifies the statement at which program execu- 
tion is to be continued following the jump. The jump label (at the entry) is posi- 
tioned in front of the operation and separated by a colon (Fig. 9.34). 


ik #Result If the result is greater than 10 000, 
1 10 000 program execution is continued at the 
>I Error jump label. 


JC laneie@ie 


meweies Tk #Number Further program 


Fig. 9.34 Example of a jump function 
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You can set the jump label prior to each statement in the block. An operation must 
always follow a jump statement. It is possible to jump within the block beyond net- 
work limits. If you use the Master Control Relay (MCR), the jump destination must 
be located in the same MCR zone or in the same MCR area as the jump function. 


The program elements catalog contains the jump functions under Basic instruc- 
tions > Basic instructions > Program control operations. 


9.6.4 Jump list 


The jump list JL enables specific (calculated) jumping to a program section in the 
block independent of a jump number. 


The JL operation works together with a list of JU jump functions. This list directly 
follows JL and can have a maximum of 255 entries. With JL there is a jump label 
which points to the end of the list (to the first statement following the list). You pro- 
gram a jump list in accordance with the general schema shown in Fig. 9.35. 


L  #Jump number The #Jump number tag loaded in accumulator 1 
JL End defines the JU jump function to be executed in 
ji | alse... the list following JL. 

JO eloredl so 5 


The jump label with the jump distributor JL 


defines the end of the list of JU statements. 
OU  ikeiloeuls 4 


End: ... //Further program 


Fig. 9.35 General schema for programming the jump distributor 


The number of the jump to be executed is present in the right byte of accumulator 1. 
If 0 is present in accumulator 1, the first jump statement is executed; if 1 is present, 
the second jump statement is executed, etc. If the number is greater than the length 
of the list, JL branches to the end of the list (to the statement located after the last 
jump). 


JL is independent of conditions and does not change the status bits. 

Only JU statements may be present in the list without gaps. You can assign any 
names to the jump labels within the context of the general specifications. 

9.6.5 Loop jump 

The loop jump LOOP permits simplified programming of loops. 


LOOP interprets the right word of accumulator 1 as an unsigned 16-bit number in 
the range from 0 to 65535. 
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During processing, LOOP initially decrements the content of accumulator 1 by one. 
If the value is not yet zero, the jump is carried out to the specified jump label. 


If the value is equal to zero following decrementing, no jump is carried out, and the 
directly following statement is processed. 


The value in accumulator 1 thus corresponds to the number of program loops to be 
executed. You must save this number in a loop counter. You can use any digital tag 
as a loop counter. 


You program a loop jump in accordance with the general schema shown in Fig. 
9.36. 


L #Number The #Number tag contains the total number of 
Next: T #Counter executed loops. 
PSN The #Number tag contains the number of loops 
fies still to be executed. 
//loop 
Zl De TP LOOP reduces the content of accumulator 1 by 


HOOP eset one unit and carries out the jump if a value of 
zero has not yet been reached. 


Fig. 9.36 General schema for programming the loop jump 


During the first cycle, the default setting for Counter is the number of loops to be 
executed. The content of Counter is loaded into the accumulator at the end of the 
program loop and decremented by the LOOP statement. If the battery content is not 
zero afterwards, the jump to the specified jump label — here Next - is performed and 
the Counter tag is updated. 


The loop jump does not change the status bits. 


9.6.6 Block functions 


The block functions are used to call and terminate logic blocks and to open data 
blocks. 


A detailed description of the block functions is provided in Chapters 14.3 “Block 
end functions” on page 575, 14.4 “Calling of code blocks” on page 576, and 14.5 
“Data block functions” on page 583. Table 9.14 shows the block functions available 
with STL. 


The program elements catalog contains the block functions under Basic instruc- 
tions > Basic instructions > Program control operations. 
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Table 9.14 Block functions with STL 
Operation | Operand Function 
BEC - Conditional block end 
BEU Absolute block end 
BE Block end 
CALL Logic block Calling a function (FC) or a system function (SFC) 
CALL #Instance Calling a function block (FB) or a system function block (SFB) as local instance 
CALL Logic block, Calling a function block (FB) or a system function block (SFB) as single instance 
data block 
UC Logic block Absolute change to a block without parameter 
CE Logic block Conditional change to a block without parameter 
OPN Data block Opening a data block using the DB register 
OPNDI Data block Opening a data block using the DI register 
CDB - Swapping data block registers 
L DBNO Loading the number of the data block opened via the DB register 
L DBLG Loading the length of the data block opened via the DB register 
L DINO Loading the number of the data block opened via the DI register 
L DILG Loading the length of the data block opened via the DI register 


Calling of logic blocks 


Fig. 9.37 shows an example of calling a function and calling a function block. 


//EC 
CALL 


A BR 
BEC 


call and jump in event of 


“Adder .STL” 
Numberl := 
Number2 := 
Number3 := 
Total = 


#Adder erro 


ldpencoue 


“Data.STL” .Number 
“Data.STL” .Number 
“Data.STL” .Number 
“Data.STL”.Result 


Ag, 


call as single instance 
; DB Adder STL’ 


“Adder .STL” 
Valuel 
Value2 
Value3 
Result 


:= “Data.STL”.Number 
:= “Data.STL”.Number 
:= “Data.STL”.Number 
t= "Detacslh Resale 


Sue ice: 


[1] 
[2] 
[3] 
[1] 
//T£ BR = “0” then error 
//Set error tag 


//and abort processing 


[4] 
[5] 
[6] 
[2] 
//T£ BR = “1” then no error 
//and block end 


Fig. 9.37 Examples of block calls in STL 


The binary result is scanned directly following calling of the function (FC), and the 
#Adder_error tag is set to “O” in the event of an error. A jump is then made to an 
error program section. 


The binary result is scanned directly following calling of the function block. The 
block is left if no errors are present - BR is then “1”. 
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Open data block 


The OPN statement opens the specified data block via the DB register, the OPNDI 
statement via the DI register. The data block can be addressed absolutely or symbol- 
ically or be a tag with parameter type BLOCK_DB. 


OPN “Motor DB” //Symbolic addressing 
OPN %DB101 //Absolute addressing 
OPN #Motor //Addressing via a block parameter 


Opening of a data block is carried out independent of any conditions. It does not in- 
fluence the result of logic operation or the accumulator contents; the nesting depth 
of the block calls is not changed. 


The opened data block must be present in the work memory. 


You need only open a data block if you wish to address a data operand individually 
(on the left in Fig. 9.38). Complete addressing together with the data block is rec- 
ommended (right), and the program editor then takes over opening of the data 
block. Refer to Chapter 4.2.2 “Absolute addressing of tags”, section “Partial ad- 
dressing of data operands” on page 98 for information on what you must observe 
with partial addressing. 


Partial addressing Complete addressing 
OPN %DB12 

L SDBW14 L SDB12.DBW14 
OPN %DB13 

2 pee L  %DB13.DBW18 

+1 NG 

OPN %DB10 

au SDBW16 ate %DB10.DBW16 


Fig. 9.38 Example of opening a data block 


Opening a data block using block parameters 


A block parameter with parameter type BLOCK_DB allows the transfer of a data 
block (or more precisely: a data block number) to the called block. Example: If an 
input parameter #Data block has the parameter type BLOCK_DB, you can open a da- 
ta block transferred as parameter: 


OPN #Data block //Open via the DB register 
OPNDI #Data block //Open via the DI register 


When calling a function block, you can also use a data block as instance data block; 
the data block is transferred as a block parameter with parameter type BLOCK_DB. 
Since the program editor is not able to check the data type of the data block used 
during runtime, you must make sure that the transferred data block also matches 
the called function block as an instance data block. 
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Example: A block parameter with parameter type BLOCK_DB and name #Motor data 
can be specified as an instance data block when calling a function block: 


CALL “Motor control”, #Motor data 
parameterl :=... 
parameter2 := ... 


9.6.7 Master Control Relay (MCR) 


The Master Control Relay controls write operations to the user memory. A detailed 
description of the MCR functions is provided in Chapter 14.6 “Master control relay” 
on page 587. 


You use the “MCRA” statement to activate an MCR area and the “MCRD” statement 
to deactivate the MCR area again. Within an MCR area, you can open an MCR zone 
using “MCR(” and close it again using “)MCR”. The program elements catalog con- 
tains the MCR functions under Basic instructions > Basic instructions > Further in- 
structions. 


The “MCRA” and “MCRD” statements are executed independent of conditions and 
do not change any status bits. 


The “MCR(” statement depends on the result of logic operation: If the RLO = “0”, the 
MCR dependency is activated in the following MCR zone and deactivated again with 
RLO = “1”. “MCR(’” terminates a binary logic operation. 


MCRA //Activate MCR 

A Z1_ control The #Z1_control tag is used to 
MCR ( //Open MCR zone 1 activate the MCR dependency in 
A Input1l all MCR zones. 

A Input2 

= Outputl 

A Z2 control The #Z2_control tag is used to 
MCR ( //Open MCR zone 2 activate the MCR dependency in 
A Input1l the nested MCR zone if the MCR 
A Input2 dependency is deactivated in the 
= Output2 “outer” MCR zone. 

)MCR //Close MCR zone 1 

)MCR //Close MCR zone 2 

MCRD //deactivate MCR 


Fig. 9.39 Example of nested MCR zones 
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Table 9.15 MCR dependency with nested MCR zones (example in Fig. 9.39) 


The #Z1_con- | The #Z2_con- | In Zone 1, With the condi- | In Zone 2, With the condi- 

trol tag is trol tag is the MCR depen- | tion fulfilled, the MCR depen- | tion fulfilled, 
dency is #Output1 is dency is #Outputz2 is 

a be ayn deactivated set to “1” deactivated set to “1" 

aig “0” deactivated set to “1” activated reset 

“0” Sor 70° activated reset activated reset 


The “)MCR” statement is executed independent of conditions and terminates a bi- 
nary logic operation. 


The example in Fig. 9.39 shows an MCR area with two nested MCR zones. The MCR 
dependency in the first MCR zone and in the subordinate MCR zone is controlled by 
the #Z1_control tag. If #Z1_control has signal state “0”, neither #Output1 nor #Out- 
put2 can be set to “1”. In the nested MCR zone, the MCR dependency is controlled by 
#Z2_control. If #Z1_control has signal state “1”, #Z2_control with signal state “O” can 
prevent setting of #Output2. Table 9.15 provides a summary of the dependencies. 


9.7 Further STL functions 


This chapter describes the operations which have a direct effect on the contents of 
the accumulators and the nil operations. You can find the statements for indirect 
addressing in Chapter 4.3 “Indirect addressing” on page 103. 


9.7.1 Accumulator functions 


The accumulator functions transfer values between the accumulators or swap bytes 
in accumulator 1. Execution of the accumulator functions is independent of the re- 
sult of logic operation and of the status bits. Neither the result of logic operation 
nor the status bits are influenced. 


Table 9.16 shows the accumulator functions of a CPU 400 available in the STL pro- 
gramming language. 


Table 9.16 Accumulator functions for a CPU 400 (STL) 


Operation | Operand | Function 

+ Constant | Add a constant value to the content of accumulator 1 

DEC Constant | Decrement the content of accumulator 1 by a constant value 

INC Constant | Increment the content of accumulator 1 by a constant value 

PUSH - Move the content of accumulators 1 to 3 to the next accumulator up 
POP Move the content of accumulators 2 to 4 to the next accumulator down 
ENT Move the content of accumulators 2 and 3 to the next accumulator up 
LEAVE Move the content of accumulators 3 and 4 to the next accumulator down 
TAK Swap the contents of accumulators 1 and 2 

CAW Swap the bytes in the right word of accumulator 1 

CAD Swap the bytes in accumulator 1 


390 


9.7 Further STL functions 


In the program elements catalog, the accumulator functions can be found under 
Basic instructions > Basic instructions > Other instructions (POP, PUSH, TAK), under 
Basic instructions > Basic instructions > Math functions (+, DEC, INC), and under Basic 
instructions > Basic instructions > Converters (CAW, CAD). 


Direct transfer between the accumulators 


The principle of operation of the PUSH, POP, ENT, LEAVE, and TAK accumulator 
functions is shown in Fig. 9.40. 


The statement PUSH moves the content of accumulators 1 to 3 to the next accumu- 
lator up. The contents of accumulator 1 are not changed by this. You can use PUSH 
to enter the same word several times into the accumulators. 


Accumulator functions for a CPU 400 (STL) 


PUSH POP ENT LEAVE TAK 
before after 
Accu 4 Accu 3 Accu 4 Accu 3 Accu 4 Accu 4 
Accu 3 Accu 2 Accu 4 Accu 2 Accu 4 Accu 3 
Accu 2 Accu 1 Accu 3 Accu 2 Accu 3 Accu 1 
Accu 1 Accu 1 Accu 2 Accu 1 Accu 1 Accu 2 
Function: 
PUSH The contents of the accumulators 1 to 3 are shifted “up”. 
POP The contents of the accumulators 2 to 4 are shifted “down”. 
ENT The contents of the accumulators 2 and 3 are shifted “up”. 
LEAVE The contents of the accumulators 3 and 4 are shifted “down”. 
TAK The contents of the accumulators 1 and 2 are changed. 


Fig. 9.40 Direct transfer between the accumulators 


The statement POP moves the content of accumulators 4 to 2 to the next accumula- 
tor down. The contents of accumulator 4 are not changed by this. POP is used to re- 
trieve the values in accumulators 2 to 4 to accumulator 1 so that they can then be 
transferred to the memory. 


The statement ENT moves the content of accumulators 2 to 3 to the next accumula- 
tor up. This does not change the content of accumulators 1 and 2. ENT in conjunc- 
tion with a loading function that follows immediately has the result that when load- 
ing, the contents of accumulators 1 to 3 are “pushed up” (similar to PUSH) and the 
new value is in accumulator 1. 
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The statement LEAVE moves the content of accumulators 2 and 3 to the next accu- 
mulator down. This does not change the content of accumulators 4 and 1. The arith- 
metic functions include the functionality of LEAVE. With LEAVE you can replicate 
the same functionality on other digital functions (e.g. a word logic operation). Pro- 
grammed for a digital function LEAVE moves the contents of the accumulators 3 
and 4 to the accumulators 2 and 3; the result of the digital function is unchanged in 
accumulator 1. The statement TAK switches the contents of accumulators 1 and 2. 
The contents of accumulators 3 and 4 are not changed. 


Examples: Accumulators as buffer 


You can permit an arithmetic function to directly follow a previous arithmetic func- 
tion (chain calculation). The result of the first function is then linked further by 
means of the next function and the accumulators serve as intermediate memories. 


L Valuel Result := (Valuel + Value2) x (Value3 — Value4) 
L Value2 

+1 

L Value3 

ENT 

L Value4 

-I 

*I 

T Result 


Example for the accumulator functions 


Accumulator assignment following execution of instruction 
Accu 1 Accu 2 Accu 3 Accu 4 
@ L "Data.STL".Messages Messages <Accu 1> <Accu 3> <Accu 4> 
@ L "Data.STL".Messages FM Edge trigger flag Messages <Accu 3> <Accu 4> 
@® XOR Changes Messages <Accu 3> <Accu 4> 
@ ENT Changes Messages Messages <Accu 3> 
© TAK Messages Changes Messages <Accu 3> 
© AD Pos. edges Changes Messages <Accu 3> 
@ T "Data.STL".Messages_ pos Pos. edges Changes Messages <Accu 3> 
POP Changes Messages <Accu 3> <Accu 3> 
@© TAK Messages Changes <Accu 3> <Accu 3> 
T "Data.STL".Messages FM Messages Changes <Accu 3> <Accu 3> 
@ INVD Neg. edges Changes <Accu 3> <Accu 3> 
@ AD Neg. edges Changes <Accu 3> <Accu 3> 
® T "Data.STL".Messages_ neg Neg. edges Changes <Accu 3> <Accu 3> 


Fig. 9.41 “Digital edge evaluation” example for the accumulator functions 
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The statement ENT moves the intermediate result (Value1 + Value2) to accumulator 
3. In the calculation of the difference (Value3 - Value4), the intermediate result 
(Valuel + Value2) is brought back to accumulator 2 and can be multiplied by the dif- 
ference in accumulator 1. 


The example for word logic operations “digital edge evaluation” on page 378 can be 
formulated in such a way that the memory accesses are minimized (Fig. 9.41). 
Swap bytes in accumulator 1 


CAW _ Exchange bytes in accumulator 1 in the right word 
CAD Exchange bytes in all of accumulator 1 


The CAW statement swaps the two right bytes in accumulator 1 (Fig. 9.42). The left 
bytes remain unaffected. 


Swap bytes 


st. @ IN; Function: 
Function; CAW The bytes in the right word of accumulator 1 are swapped. 
T OUT; CAD The bytes of accumulator 1 are swapped. 
Data width DWORD WORD 
STL-instruction CAD CAW 
IN parameter Byte a Byte b Byte c Byte d Byte a Byte b 
OUT parameter Byte d Byte c Byte b Byte a Byte b Byte a 


Fig. 9.42 Swapping bytes in accumulator 1 


The CAD statement swaps all bytes in accumulator 1. The byte present on the far 
left is present on the far right following CAD; the two bytes in the middle swap lo- 
cations. 


9.7.2. Adding of constants to accumulator 1 


The addition of constants to accumulator 1 is used in the programming language 
STL (Fig. 9.43). In the other programming languages, the arithmetic addition is 
used for this. 


16#bb //Adding of a byte constant 
tw //Adding of a word constant 
L#td //Adding of a doubleword constant 


You program the addition of a constant according to the following general schema: 


L Tag 
Addition of constant 
Result 


The addition of a constant is preferably used for calculating addresses since - 
unlike an arithmetic function — it influences neither the contents of the remaining 
accumulators nor the status bits. 
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Addition of constant to accumulator 1 (STL) 
STL 


L #Value Function: 
4+ <#Constant> The specified constant — which can also be negative - is added to the 
T #Result contents of accumulator 1 without changing the assignment of 


accumulator 2. If the constant has a byte or word width, only the right 
word in accumulator 1 is changed. You can identify a constant of 
doubleword width by means of an "#L" in front of the constant, 

e.g. L#-123. 


Fig. 9.43 Addition of constant 


The “Add constant” statement adds the constant present in the operation to the con- 
tent of accumulator 1. You can specify this constant as a byte constant in hexadeci- 
mal form or as a word and doubleword constant in decimal form. If you wish to car- 
ry out the addition of a word constant as a DINT calculation, write L# in front of the 
constant. If the specified decimal constant is greater than the INT numerical range, 
a DINT calculation is automatically carried out. 


You can specify a minus sign for a decimal number in order to also carry out the 
subtraction of constants. Prior to the addition of a byte constant, this is extended to 
an INT number with the correct sign. 


The addition of a byte or word constant only influences the right word in accumu- 
lator 1, as with a calculation with data type INT; transfer to the left word does not 
take place. 


Bit 15 (the sign bit) is overwritten if the INT range of values is exceeded. The addi- 
tion of a doubleword constant influences all 32 bits of accumulator 1 in accordance 
with a DINT calculation. 


Execution of these statements is independent of conditions. 


9.7.3. Decrementing, incrementing 


Decrementing and incrementing are used in the programming language STL. 
These functions can be emulated in other programming languages (Fig. 9.44). 


DEC n Decrement 
INC n Increment 


You program decrementing and incrementing according to the following general 
schema: 


L Tag 

DEC n //Reduce content of tags by n 

T Result 

L Tag 

INC n //Increase content of tags by n 
T Result 


The decrement and increment statements change the value present in accumula- 
tor 1. It is reduced (decremented) or increased (incremented) by the number of 
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units specified in the parameter of this statement. The parameter can have values 
from 0 to 255. 


The accumulator content is only changed in the right byte. Transfer to the bytes on 
the left is not carried out. The calculation is carried out “modulo 256”, i.e. when in- 
creasing above a value of 255, counting restarts at the beginning, or when decreas- 
ing below a value of 0, counting restarts at 255. 


Execution of the decrement and increment statements is independent of the result 
of logic operation. They are always executed and influence neither the result of log- 
ic operation nor the status bits. 


Decrementing, incrementing 


STL i, #Value Function: 
DEC <Decrement> DEC reduces the value in accumulator 1 by the specified parameter; 
ae #Result INC increases it by the specified parameter. The parameter can be 
within the range 0 to 255. The change is only effective on the right byte 
L #Value in accumulator 1. The calculation is executed "modulo", i.e. if the value 
INC <Increment> is reduced below 0 or increased above 255, counting commerces again 
T #Result at 255 or 0. 


Fig. 9.44 Decrementing and incrementing 


9.7.4 Null instructions 


Null instructions result in no response whatsoever by the control processor during 
execution. Table 9.17 shows the null instructions available with STL. 


Table 9.17 Null instructions with STL 


Operation | Operand | Function 


BLD Number Controls the construction of an LAD or FBD representation 
NOP 0 Statement with memory content W#16#0000 
NOP 1 Statement with memory content W#16#FFFF 


The program elements catalog contains the null instructions under Basic instruc- 
tions > Basic instructions > Other instructions. 


NOP instructions 


You can use the NOP 0 (bit pattern 16-times “O”) and NOP 1 (bit pattern 16-times 
“1”) statements to enter a statement which has no effect. Note that the nil opera- 
tions occupy memory space (2 bytes) and have a command runtime. 


Example: A statement must always be present for a jump label. Use NOP 0 if you 
wish to have nothing executed at an entry in your program. 
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A I 1.0 
JC MXxX1 


MXX1: NOP 0 
An empty line for clearer commenting of programs can be entered more effectively 


using an (empty) line comment (no memory requirements in user memory and no 
runtime losses since no code is sent). 


BLD instruction 


The program editor uses BLD nnn display construction statements to integrate 
information for decompilation into the program. 
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10 Structured Control Language SCL 


10.1 Introduction to programming with SCL 


This chapter describes programming with Structured Control Language (SCL); it 
uses examples to show how the program functions are represented in SCL. You can 
find a description of the individual functions, e.g. comparison functions, in Chap- 
ters 12 “Basic functions” on page 461, 13 “Digital functions” on page 507, and 14 
“Program flow control” on page 560. 


Use of the program and symbol editor, which generally applies to all programming 
languages, is described in Chapter 6 “Program editor” on page 253. 


SCL is used to program the contents of blocks (the user program). What blocks are, 
and how they are created, is described in Chapters 5.2.3 “Block types” on page 156 
and 6.3 “Programming a code block” on page 257. 


10.1.1 Programming with SCL in general 


You use SCL to program the control function of the programmable controller - the 
user program (control program). The user program is organized in different types 
of blocks. 


Fig. 10.1 shows the SCL program for a FIFO register. With a rising edge at #Write, 
this block writes the value present at the #Input parameter into a FIFO register. With 
arising edge at #Read, the value at #Output is output again. The values are read out 
in the order in which they were written into the register (FIFO, first in first out). The 
register can be emptied using #Delete. The two displays #Full and #Empty show the 
status of the register (#Full and #Empty are each set following writing or reading). 
The block works with a write pointer and a read pointer. 


The program editor constructs an SCL program line by line. You commence with the 
first statement in the first line. Each SCL statement is concluded by a semicolon. 
You can write several statements in one line, or one statement can occupy several 
lines. 


You can make the SCL program clearer and easier to read by using comments and 
empty lines. Comments and empty lines have no influence on the function of the 
SCL program. 


Line comments commence with two slashes and terminate at the end of the line. 
Block comments commence with left parenthesis and asterisk, can extend over 
several lines, and terminate with asterisk and right parenthesis. 
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Project400 > Examples400 [CPU 412-2 PN] > Program blocks » Examples.SCL > Examples.SCL [FB41] 


SSfh SP COD GBS 'a'= NAA HF Ed 


Ts or 
//Example FIFO register a 


I = bededecheteceteheecbeheheeleiiehadtochetadeehededalohebelehehedelaleheheieheleheleteheheleiehehehbaletehaieletieieieteieieieteieieieleleieistetelelel 


i 
2 
3 Check| control inputs 
Ory 
5 GIF #Write AND NOT #Write_EM 

6 THEN #Write_EM := #Write; GOTO Write_register; 

7 ELSE #Write_EM := #Write; 

@ | END_IF; 

9 PIF #Read AND NOT #Read_EM 

0 THEN #Read_EM := #Read; GOTO Read_register; 


11 ELSE #Read_EM := #Read; 

12 |END_IF; 

13 HIF #Delete AND NOT #Delete_EM 

14 THEN #Delete_EM := #Delete; GOTO Delete_register; 
15 ELSE #Delete_EM := #Delete; 

16 | END_IF; 

17 RETURN; 


1 CEES E SEES SESE SE EEE SESE SEIS ESE ISS ISIS IG EGE IO Ea aaa rat) 
19 Write_register: 
20 HIF #Level = #Register_legth - 1 


a} THEN #Full := TRUE; 

2 ELSE #Register[#Write_pointer] := #Input_value; 
3 #Llevel := #Llevel + 1; 

46 IF #Write_pointer = #Register_legth 

5 


THEN #Write_pointer := 0; 
ELSE #Write_pointer : 
END_IF; 
#Empty := FALSE; 
|END_IF; RETURN; 


EEE IER IIR IRA RR EA RRR Ra RE HEE) 


#Write_pointer + 1; 


© © 


OWNNNNNNNNN 
oS a 


hey 


Read_register: 
GIF #Level = 0 
THEN #Empty := TRUE; #Output := 0; 
ELSE #Output_value := #Register[#Read_pointer]; 
#Llevel := #Level - 1; 
6 IF #Read_pointer = #Register_legth 
THEN #Read_pointer := 0; 
ELSE #Read_pointer := #Read_pointer + 1; 
END_IF; 
0 #Full := FALSE; 
[END_IF; RETURN; 


(AHHH ani bola oi iE a iti iota iia aoa a i a ia a a a ak ete) 


43 Delete_register: 

44 #Output := 0; #Level := 0; 

45 #Write_pointer := 0; #Read_pointer := 0; 
46 #Full := FALSE; #Empty := FALSE; 


17 GES SB SHEESH SSH E SEE HOS EEE HOES EHO EEHE HOE EEEEOEOHOrSbEbbi iii) 


48 (** Block end **) 


3 uF 


Fig. 10.1 Example of a block with SCL program 


In order to program an SCL statement, use the keyboard to enter the statements in 
a line of the input field. Dragging the statement with the mouse from the program 
elements catalog is of advantage with SCL if you import functions with a parameter 
list into your program. To call self-created blocks, drag them from the Program 
blocks folder into a line. 


10.1.2 SCL statements and operators 


The SCL program consists of a sequence of individual STL statements. Fig. 10.2 
shows which types of SCL statements exist. 
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SCL statements 


SCL instruction 


An SCL instruction consists of a jump label with subsequent colon and the actual instruction, which is 
terminated by a semicolon. The instruction can extend over several lines. The instruction can be 
followed by a (line) comment, which is commenced by two slashes and extends up to the end of the 
line. The jump label and the line comment can be omitted. 


General SCL instruction 


| 


Label : SCL statement ; I Comment 


Value assignment 


A value assignment transfers the value of an expression to a tag. An expression can be a single tag or 
a formula for calculating a value. A formula links the tags by means of operators. Depending on the 
type of linking, a distinction is made between arithmetic expressions, comparison expressions, and 
logical expressions. 


Value assignment with assignment operator 
Pi 


c \ 
Label + Tag ‘= Expression > I Comment 
#Result t= #Tag AND #Tag ; Logical expression 
#Result t= #Tag >= #Tag ; Comparison expression 
#Result t= #Tag + #Tag ; Arithmetic expression 


Control statement 


A control statement controls the processing sequence in the program by means of branching and 
program loops which can be processed repeatedly. A control statement commences with a 
keyword (xxx) and is terminated by END_xxx. 


Control statement 
A... 


r \ 

Label t XXX Instruction sequence END_xxx > I Comment 
IF Instruction sequence END_IF ; IF branch 
CASE Instruction sequence END_CASE ; CASE branch 
FOR Instruction sequence END_FOR 3 FORloop 
WHILE Instruction sequence END_WHILE 5 WHILE loop 
REPEAT Instruction sequence END_REPEAT 3 REPEAT loop 


Block call 


The call of a block without return value consists of the block name and the following parameter list in 
parentheses. If the block has a return value, the block call following an assignment operator is present 
in a value assignment or an expression. 


Most extended instructions in the program element catalog are calls of system blocks with return value. 


Block call 
‘ As ~ 
Label : Block name (parameter list) > I Comment 
Tag := block name (parameter list) . 


Fig. 10.2 Types of SCL statements 
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The simplest case with a Value assignment is that the content of a tag is transferred 
to another tag. Control statements control the program execution, for example with 
program loops. Block calls are used to continue program execution in the called 
block. 


Operators 


An expression represents a value. It can comprise a single operand (a single tag) or 
several operands (tags) which are linked by operators. 


Example: “a+b” is an expression; “a” and “b” are operands, “+” is the operator. 


The sequence of logic operations is defined by the priority of the operators and can 
be controlled by parentheses. Mixing of expressions is permissible providing the 
data types generated during calculation of the expression permit this. 


SCL provides the operators specified in Table 10.1. Operators of equal priority are 
processed from the left to the right. 


Table 10.1 Operators with SCL 


Logic operation Name Operator Priority 
Parentheses Left parenthesis, right parenthesis (,) 1 
Arithmetic Power = 2 
Unary plus, unary minus (sign) +,- 3 
Multiplication, division * 1, DIV, MOD 4 
Addition, subtraction +,- 5 
Comparison Less than, less than-equal to, greater than, <, <=, >, >= 6 


greater than-equal to 


Equal to, not equal to =,<> 7 
Binary logic operation | Negation (unary) NOT 3 
AND logic operation AND, & 8 
Exclusive OR XOR 9 
OR logic operation OR 10 
Assignment Assignment = 11 


“Unary” means that this operator has a fixed assignment to an operand 


Expressions 


An expression is a formula for calculating a value and consists of operands (tags) 
and operators. In the simplest case, an expression is an operand, a tag, or a con- 
stant. A sign or a negation can also be included. 


An expression can consist of operands which are linked together by operators. 
Expressions can also be linked by operators. Expression can therefore have a very 
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complex structure. Parentheses can be used to control the processing sequence in 
an expression. 


The result of an expression can be assigned to a tag or a block parameter or used as 
a condition in a control statement. 


Expressions are distinguished according to the type of logic operation into arithme- 
tic expressions, comparison expressions, and logic expressions. 


10.2 Programming binary logic operations with SCL 


The binary logic operations are executed in SCL with logic expressions in conjunc- 
tion with binary tags or expressions which deliver a binary result. The binary oper- 
ations can be “nested” using parentheses and thus influence the processing 
sequence (Table 10.2). 


Table 10.2 Binary logic operations with SCL 


Operation | Operand Function 

& Binary operand or binary Scan for signal state “1” and link according to AND logic 
expression operation 

AND Binary operand or binary Scan for signal state “1” and link according to AND logic 
expression operation 

OR Binary operand or binary Scan for signal state “1” and link according to OR logic 
expression operation 

XOR Binary operand or binary Scan for signal state “1” and link according to exclusive OR 
expression logic operation 

NOT - Negation of result of logic operation 


10.2.1 Scanning for signal states “1” and “0” 


The scanning of a binary operand in SCL is always the direct scanning of the status 
of the binary operand. This corresponds to scanning for signal state “1”. If scanning 
for signal state “O” is required for the program function, one uses the NOT operator 
in order to negate the result of scan. NOT can also be used to negate the result of 
binary expressions. 


The example in Fig. 10.3 shows the two “Start” and “Stop” pushbuttons. When 
pressed, they output the signal state “1” in the case of an input module with sinking 
input. This signal state is used in the logic operation. 


The “/Fault” signal is not active in the normal case. Signal state “1” is then present 
and is negated by means of the NOT operator, and therefore it does not result in 
resetting of the “Fan” tag. If “/Fault” becomes active, the “Fan” tag is to be reset. The 
active “/Fault” signal delivers signal state “O” and results in resetting of “Fan”. 
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Example of scans for signal state "1" and signal state "0" 


When pressed, the "Start" and "Stop" keys switch the fan on and off. 

They are "1-active" signals. If '/Fault" becomes active, the fan is to be switched off 
and remain off. "/Fault" is a"0-active" signal. In order to reset "Fan", the result of 
the scan is negated with NOT. 


In the example, the 0-active signal is identified by a slash in front of the name. 


Fig. 10.3 Scanning for signal states “1” and “0” 


The logic expression in the example uses NOT both for negation of the result of scan 
of “/Fault” and for negation of the result of the second OR function. You can also for- 
mulate the logic operation differently: 


“Fan”’:=(“Start” OR “Fan”) AND NOT “Stop” AND “/Fault”; 


10.2.2 AND function 


An AND function is fulfilled if all function inputs have the result of scan “1”. A 
description of the AND function is provided in Chapter 12.1.3 “AND function, series 
connection” on page 464. 


SCL implements the AND logic operation using a logic expression with the opera- 
tors & or AND, which link binary tags or binary expressions. 


Fig. 10.4 shows an example of an AND logic operation. The #Fan1.running and 
#Fan2.running tags are scanned for signal state “1”, and the two results of the scans 
are linked according to an AND logic operation. The AND function is fulfilled (deliv- 
ers signal state “1”) if both fans are running. 


//AND function 
#Display.twoFans := #Fanl.running AND #Fan2.running; 


//OR function 
#Display.Min oneFan := #Fanl.running OR #Fan2.running; 


//exclusive OR function 
#Display.oneFan := #Fanl.running XOR #Fan2.running; 


Fig. 10.4 Examples of binary logic operations with SCL 
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10.2.3 OR function 


An OR function is fulfilled if one or more function inputs have the result of scan “1”. 
A description of the OR function is provided in Chapter 12.1.4 “OR function, parallel 
connection” on page 465. 


SCL implements the OR logic operation using a logic expression with the operator 
OR, which links binary tags or binary expressions. 


Fig. 10.4 shows an example of an OR logic operation. The #Fan1.running and 
#Fan2.running tags are scanned for signal state “1”, and the two results of the scans 
are linked according to an OR logic operation. The OR function is fulfilled (delivers 
signal state “1”) if one of the fans is running or if both fans are running. 


10.2.4 Exclusive OR function 


An exclusive OR function (antivalence function) is fulfilled if an odd number of 
function inputs has the scan result “1”. A description of the exclusive OR function is 
provided in Chapter 12.1.5 “Exclusive OR function, non-equivalence function” on 
page 465. 


SCL implements the exclusive OR logic operation using a logic expression with the 
operator XOR, which links binary tags or binary expressions. 


Fig. 10.4 shows an example of an exclusive OR logic operation. The #Fan1.running 
and #Fan2.running tags are scanned for signal state “1”, and the two results of the 
scans are linked by an exclusive OR logic operation. The exclusive OR function is 
fulfilled (delivers signal state “1”) if only one of the fans is running. 


10.2.5 Combined binary logic operations 


The AND, OR, and exclusive OR functions can be freely combined with one another. 
With SCL the operators have the following priority regarding execution: AND or & 
are executed before XOR, followed by OR. NOT is executed before the logic opera- 
tion operators. 


Logic operations such as the ORing of AND functions do not require parentheses, as 
shown in the top example in Fig. 10.5. The first AND function is fulfilled if fan 1 is 
running and fan 2 is not running, the second function if fan 1 is not running and 
fan 2 is running. The #Display.oneFan_1 tag is set if the first AND function is fulfilled 
or if the second AND function is fulfilled (or if both are fulfilled, but this is not the 
case in this example). 


//ORing of AND functions - does not require parentheses 

#Display.oneFan 1 := #Fanl.running AND NOT #Fan2.running 
OR NOT #Fanl.running AND #Fan2.running; 

//ANDing of OR functions - parentheses required 

#Display.oneFan 2 := (#Fanl.running OR #Fan2.running) 
AND (NOT #Fanl.running OR NOT #Fan2.running); 


Fig. 10.5 Examples of combined binary logic operations with SCL 
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This logic operation does not require parentheses since the AND function is pro- 
cessed “before” the OR function because of its higher priority. This also applies to 
ORing of exclusive OR functions or the exclusive ORing of AND functions. 


The processing priority can be influenced using parentheses. The expressions in 
the parentheses are processed first as it were. Parentheses can be nested. 


Logic operations such as the ANDing of OR functions require parentheses, as shown 
in the bottom example in Fig. 10.5. The first OR function is fulfilled if at least one 
fan is running or if both fans are running, the second if at least one fan is not run- 
ning or if neither fan is running. The two OR functions are present in parentheses 
and the results of the logic operation are linked according to an AND logic opera- 
tion. The #Display.oneFan_2 tag is set if only one of the fans is running. 


10.2.6 Negating result of logic operation 


The NOT operator negates the result of logic operation at any position in an logic 
operation. Using the NOT operator it is possible in a simple manner to obtain: 


> aNAND function (negated AND function, is fulfilled if at least one input has the 
result of scan “0”), 


> a NOR function (negated OR function, is fulfilled if all inputs have the result of 
scan “O”), and 


> an inclusive OR function (equivalence function, negated exclusive OR function, 
is fulfilled if an even number of inputs has the result of scan “1”). 


Fig. 10.6 shows the negation of binary functions. The functions are present in 
parentheses since they have a lower processing priority than NOT. The result of the 
binary function is generated first and subsequently negated. 


//NAND function —- at least one fan not running 

#Display.nand := NOT (#Fanl.running AND #Fan2.running) ; 

//NOR function — no fan running 

#Display.nor := NOT (#Fanl.running OR #Fan2.running) ; 

//Inclusive OR function - neither of the fans or both fans are running 
#Display.nxor := NOT (#Fanl.running XOR #Fan2.running) ; 


Fig. 10.6 Examples of the negation of binary functions 


10.3 Programming memory functions with SCL 


The memory functions control binary tags such as outputs or bit memories. SCL has 
the value assignment as memory function. The set and reset statements standard 
with LAD, FBD, and STL can be emulated. 
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10.3.1 Value assignment of a binary tag 


The value assignment directly assigns the current result of logic operation to the 
binary tag named in front of the operator. The response of the assignment is 
described in Chapter 12.2.2 “Standard coil, assignment” on page 469. 


An example of a (binary) value assignment is shown in Fig. 10.7. The #Fan1.drive 
tag is set to signal state “1” if the logic operation is fulfilled or to signal state “O” if 
the logic operation is not fulfilled. 


//Assignment of value to a binary tag 
#Fanl.drive := (#Fanl.start OR #Fanl.drive) 
AND NOT #Fanl.stop AND #Fanl.fault; 


//Set tag with RLO = “1” 
IF #Fan2.start THEN #Fan2.drive := TRUE; END_IF; 
// Reset tag with RLO = “1” 
IF #Fan2.stop OR NOT #Fan2.fault 
THEN #Fan2.drive := FALSE; END_IF; 


Fig. 10.7 Assigning, setting, and resetting with SCL 


10.3.2 Setting and resetting 


The set and reset operations present with LAD, FBD, and STL (see Chapter 12.2 
“Memory functions” on page 468) can be emulated with SCL, for example, using a 
simple IF branch. 


In Fig. 10.7, the #Fan2.drive tag is set to signal state “1” if the #Fan2.start tag has 
signal state “1”. If #Fan2.start has signal state “0”, #Fan2.drive is not influenced. Re- 
setting of #Fan2.drive is carried out in a similar manner: If the #Fan2.stop OR NOT 
#Fan2.fault expression is fulfilled, #Fan2.drive is set to signal state “O”. An expres- 
sion which is not fulfilled does not influence #Fan2.drive. Resetting is programmed 
following setting and is therefore “dominant”. If both conditions are fulfilled, 
#Fan2.drive is reset or remains reset. 


10.3.3 Edge evaluation 


Edge evaluation detects a change in a binary signal state. 


With SCL, a change in signal state can be detected by comparing the current signal 
state with the previous one. The previous signal state is saved in a so-called edge 
trigger flag. This is, for example, a bit from the bit memories or data operand area. 


Fig. 10.8 shows an example with rising (positive) and falling (negative) edges. 


With the first edge evaluation, a pulse flag (#Alarm.pulse_pos) is generated which, 
with a positive edge, has signal state “1” for the duration of one program cycle. This 
pulse flag can be used in the user program to carry out actions; in the example the 
#Alarm.memory tag is set to TRUE. Following the pulse generation, the edge trigger 
flag must be updated. 


405 


10 Structured Control Language SCL 


The second edge evaluation is implemented using an IF statement. If a negative 
edge is detected, #Alarm.memory is reset to FALSE. This is followed by updating of 
the edge trigger flag. 


//Set alarm memory with positive signal edge 


Alarm.pulse pos := #Alarm.bit AND NOT #Alarm.edge_ pos; 
Alarm.edge pos := #Alarm.bit; 
F #Alarm.pulse pos THEN #Alarm.memory := TRUE; END_IF; 


//Reset alarm memory with negative signal edge 
F NOT #Alarm.ack AND #Alarm.edge_neg 

THEN #Alarm.memory := FALSE; END IF; 
Alarm.edge neg := #Alarm.ack; 


Fig. 10.8 Examples of edge evaluation with SCL 


10.4 Programming timer and counter functions 
with SCL 


10.4.1 SIMATIC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
SIMATIC timer functions are an operand area in the CPU's system memory and their 
number is limited. SCL handles a SIMATIC timer function like a function with func- 
tion value. Table 10.3 shows the parameters possible in association with a function 
call of a SIMATIC timer. How the SIMATIC timer functions respond is described in 
detail in Chapter 12.3 “SIMATIC timer functions” on page 477. 


For programming, enter the tag for the function value and the assignment operator 
in a line. Drag the function call with the mouse from the program elements catalog 
under Basic instructions > Timer operations into the input line. Then replace the 


Table 10.3 Call of SIMATIC timer functions with SCL 


Timer function | Parameter Data type Description 
Function value | SSTIME, TIME Current time value 
S_ PULSE Start timer as pulse 
S_PEXT Start timer as extended pulse 
S_ODT Start timer as ON delay 
S_ODTS Start timer as retentive ON delay 
S_OFFDT Start timer as OFF delay 
T_NO TIMER Time operand (T) 
S BOOL Start input 
TV S5TIME Default time value 
R BOOL Reset input 
BI WORD Current integer-coded time value 
Q BOOL Binary status of timer function 
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//Switch fan on and off with delay 


PeSMS SotwmMe g= S_ODM Cr INO g= “wens ei Claleny", S g= Gwewais .Siceieic, 
TV := SST#3s, Q => #temp bool); 

#temp SSTime := S OFFDT(T_NO := “Fan5.off delay”, S := #temp_ bool, 
TV := #Follow-up_time, Q => #Fan5.drive) ; 


Fig. 10.9 Example of application of SIMATIC timer functions 


dummy values by the actual parameters in the function call. Delete non-required 
parameters including their name. 


In Fig. 10.9, the time “Fan5.on_delay” is started as an ON delay by the positive edge 
of #Fan5.start. Following expiry of the duration, the timer function “Fan5.off_delay” 
is started with the duration present as a value in the #Follow-up_time tag. The status 
of the timer function “Fan.off_delay” simultaneously has signal state “1” so that 
fan 5 is switched on following the ON delay. Once the start signal #Fan5.start has 
signal state “O”, fan 5 continues to run for the follow-up time and is then switched 
off. 


10.4.2 SIMATIC counter functions 


Counter functions are used to implement counting tasks in the user program. 
SIMATIC counter functions are an operand area in the CPU's system memory and 
their number is limited. SCL handles a SIMATIC counter function like a function 
with function value. Table 10.4 shows the parameters possible in association with a 
function call of a SIMATIC counter. How a SIMATIC counter function responds is de- 
scribed in detail in Chapter 12.5 “SIMATIC counter functions” on page 495. 


For programming, enter the tag for the function value and the assignment opera- 
tor in a line. Drag the function call with the mouse from the program elements cat- 
alog under Basic instructions > Counter operations into the input line. Then replace 
the dummy values by the actual parameters in the function call. Delete non-re- 
quired parameters including their name. 


Table 10.4 Call of SIMATIC counter functions with SCL 


Timer func- Parameter Data type Description 
tion 
Function value | WORD Current count value 
S_CU Up counter 
S_CD Down counter 
S_CUD Up/down counter 
C_NO COUNTER Counter operand (C) 
S BOOL Set input 
PV WORD Default count value 
BOOL Reset input 
Bl WORD Current integer-coded count value 
Q BOOL Binary status of counter function 


407 


10 Structured Control Language SCL 


//Simple parts counter 


#temp word := S CD(C_NO := "Parts counter", CD := #Workpiece identified, 
S := #Quantity set, PV := 16#0120, Q => #temp bool); 
#Quantity reached := NOT #temp_ bool; 


Fig. 10.10 Example of application of a SIMATIC counter function with SCL 


Fig. 10.10 shows the counting of workpieces up to a specific quantity. The counter 
#Parts_counter is set by the #Quantity_set tag to a start value of 120. Each positive 
edge at the #Workpiece_identified tag decrements the count value by one unit. If a 
value of zero is reached - the counter status is then “O” - #Quantity_reached is set. 


10.4.3 IEC timer functions 


Timer functions are used to implement dynamic processes in the user program. 
With a CPU 400, an IEC timer function is a system function block (SFB) in the oper- 
ating system and is called in the user program like a function block. A detailed de- 
scription of the IEC timer functions is provided in Chapter 12.4 “IEC timer func- 
tions” on page 491. 


For programming, drag the corresponding symbol (TP, TON, or TOF) with the 
mouse from the program elements catalog under Basic instructions > Timer opera- 
tions into a line on the working area. When positioning, you select either as single 
instance or as local instance. The instance data block generated automatically when 
selecting as a single instance is saved in the project tree under Program blocks > Sys- 
tem blocks > Program resources. 


With the IEC timer functions, a binary tag must be connected to the IN input, and a 
duration to the PT input. You can also directly access the output parameters using 
the instance data, for example with “DB name”.Q for a single instance or #In- 
stance_name.Q for a local instance. 


Fig. 10.11 shows the IEC timer function #Message_delay, which saves its data as lo- 
cal instance in the instance data block of the calling function block. If the #Measure- 
ment_too_high tag has a signal state “1” for longer than 10 s, #Message_too_high is 
set. 


//Message delay 
#Message delay(IN := #Measurement_too high, PT := T#10s, 
Q => #Message too high); 


Fig. 10.11 Example of IEC timer function with SCL 


10.4.4 IEC counter functions 


A counter function implements counting processes in the user program. With a CPU 
400, an IEC counter function is a system function block (SFB) in the operating sys- 
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tem and is called in the user program like a function block. A detailed description 
of the IEC counter functions is provided in Chapter 12.6 “IEC counter functions” on 
page 502. 


For programming, drag the corresponding symbol (CTU, CTD, or CTUD) with the 
mouse from the program elements catalog under Basic instructions > Counter oper- 
ations into a line on the working area. When positioning, you select either as single 
instance or as local instance. The instance data block generated automatically when 
selecting as a single instance is saved in the project tree under Program blocks > Sys- 
tem blocks > Program resources. 


With the IEC counter functions, a binary tag must be connected to at least one 
counter input (CU or CD). Connection of the other function inputs and outputs is 
optional. You can also directly access the output parameters using the instance 
data, for example with “DB_name”.QD for a single instance or #Instance_name.QD 
for a local instance. 


Fig. 10.12 shows the IEC counter function #Lock_counter, which is called as a local 
instance. It has saved its data in the instance data block of the calling function block. 
A component of the counter can be addressed globally with the name of the 
instance and the component name, for example #Lock_counter.CV. The example 
shows the passages through a lock, either forward or backward. 


//Simple lock counter 


#temp_booll := #Light_barrierl AND NOT #™“Light_barrierl.edge”; 
#’ Light barrierl.edge” := #Light_barrier1l; 
#temp_bool2 := #Light_barrier2 AND NOT #™“Light_barrier2.edge”; 
#’ Light barrier2.edge” := #Light_barrier2; 
#Lock_counter(CU := #Light_barrier2 AND #temp_booll, 

CD := #Light_barrierl AND #temp_bool2, 

R := #Acknowledge, LD := FALSE, PV := 0); 


Fig. 10.12 Example of IEC counter function with SCL 


10.5 Programming digital functions with SCL 


The digital functions process digital values mainly with the data types INT, DINT, 
and REAL. 


The “simple” digital functions are implemented with SCL through the value assign- 
ment of an expression. When linking two values, the type of digital function 
depends on the operator used: comparison expression (comparison functions), 
arithmetic expression (arithmetic and mathematical functions), or logic expres- 
sion (word logic operations). The functions for data type conversion (conversion 
functions) and for shifting and rotating are available for manipulating just one 
value. 
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10.5.1 Transfer function, value assignment of a digital tag 


The “simple” transfer function corresponds with SCL to the value assignment. 


A detailed description of the transfer functions is provided in Chapter 13.2 “Trans- 
fer functions” on page 508. Example of a value assignment: The value of the #Mes- 
sages tag in data block “Data.SCL” is assigned to the “Message_bits” tag in the mem- 
ory area. 


“Message bits” := “Data.SCL”.Messages; 


10.5.2 Comparison functions 


A comparison function compares the values of two tags. 


SCL implements the comparison function using a comparison operator. The com- 
parison result has the data type BOOL and can be linked further like a Boolean tag. 
The comparison result has signal state TRUE if the comparison is fulfilled, other- 
wise FALSE. The comparison function is described in Chapter 13.3 “Comparison 
functions” on page 518. Table 10.5 shows the comparison operators available with 
SCL. 


Table 10.5 Comparison functions with SCL 


Operator Description Operand data types 

= Compare for equal INT, DINT, REAL, 

<> Compare for unequal CHAR, STRING, 

< Compare for greater than TIME, DATE, TIME_OF_DAY 
<= Compare for greater than-equal 

> Compare for less than 

>= Compare for less than-equal 

= Compare for equal BOOL, BYTE, WORD, DWORD 
<> Compare for unequal 


Two comparison functions are programmed in Fig. 10.13. In the first comparison, 
the #Measurement_temperature tag is compared with “Lower_limit”, in the second 
comparison with “Upper_limit”. The result of the two comparisons is linked accord- 
ing to AND and saved in the #Measurement_in_range tag. “Lower_limit” and “Up- 
per_limit” are created as symbolically addressed user constants. 


#Measurement_in_range := (#Measurement_temperature >= "Lower limit") AND 
(Measurement temperature <= "Upper limit"); 


Fig. 10.13 Example of comparison expressions with SCL 
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10.5.3 Arithmetic functions 


The arithmetic functions for numerical values implement the basic arithmetical 
operations with the data formats INT, DINT, and REAL. SCL uses an arithmetic op- 
erator for this. 


The program elements catalog contains the arithmetic functions under Basic 
instructions > Math functions. 


A detailed description of these arithmetic functions is provided in Chapter 13.4 
“Arithmetic functions” on page 521. Table 10.6 shows the arithmetic operators 
available with SCL. 


Table 10.6 Arithmetic functions with SCL 


Data type 
Operator Description 1. operand 2. operand Result 
hed Power INT, DINT, REAL INT REAL 
= Multiplication INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL 
TIME INT, DINT TIME 
| Division INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL 
DIV Integer division INT, DINT INT, DINT INT, DINT 
TIME INT, DINT TIME 
MOD Division with remainder as result | INT, DINT INT, DINT INT, DINT 
+ Addition INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL 
TIME TIME TIME 
TOD TIME TOD 
DT TIME DT 
- Subtraction INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL 
TIME TIME TIME 
TOD TIME TOD 
DATE DATE TIME 
TOD TOD TIME 
DT TIME DT 


The data type of the first and second operands can be INT, DINT, or REAL. If you link 
INT and DINT operands together, the result is of data type DINT; if you link an INT 
or DINT operand with a REAL operand, the result is of data type REAL. The program 
editor carries out a corresponding data type conversion (not visible to the user) pri- 
or to the arithmetic operation (see also Chapter 13.6.1 “Implicit data type conver- 
sion” on page 531). 


In the case of a division, the second operand must not be zero. 


In Fig. 10.14, the upper limit of a measured value is monitored. A hysteresis is 
introduced to ensure that the #4Measurement_too_high and #Measurement_too_low 
messages do not “pulsate” when the measurement changes rapidly around the 
upper or lower limit. The messages are only canceled when the measured value has 
dropped again below the upper limit or risen again above the upper limit by the 
magnitude of the hysteresis. 
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IF #Measurement_ temperature >= “Upper limit” 


THEN #Measurement_too_high := TRUE; END IF; 
Ir #Measurement temperature <= “Upper limit” — “Hysteresis” 
THEN #Measurement_too_ high := FALSE; END IF; 


IF #Measurement_temperature <= “Lower limit” 
THEN #Measurement_too_low:= TRUE; END IF; 

IF #Measurement_temperature >= “Lower limit” + “Hysteresis” 
THEN #Measurement_too_low:= FALSE; END IF; 


Fig. 10.14 Example of arithmetic expressions with SCL 


10.5.4 Math functions 


The mathematical functions comprise the trigonometric functions, exponential 
functions, and logarithmic functions, and deliver a result in data format REAL. 


A detailed description of these math functions is provided in Chapter 13.5 “Math 
functions” on page 527. Table 10.7 shows the mathematical functions available 
with SCL. 


Table 10.7 Math functions with SCL 


Operation | Function Operation | Function 

SIN Calculate sine ASIN Calculate arcsine 

cos Calculate cosine ACOS Calculate arccosine 

TAN Calculate tangent ATAN Calculate arctangent 

SQR Generate square EXP Generate exponential function to base e 
SQRT Extract square root LN Generate Napierian logarithm (to base e) 


The program elements catalog contains the arithmetic functions under Basic 
instructions > Basic instructions > Math functions. 


Fig. 10.15 shows the calculation of reactive power using the SIN function, calcula- 
tion of the volume of a sphere, the solution of a quadratic equation, and calculation 
of an arithmetic mean value. 


#Reactive power := #Voltage * #Current * SIN(#phi); 
#Volume := 4/3 * “pi” * #Radius**3; 

#Solution_1 := -#p/2 + SORT(SOR(#p/2) - #q); 
#Mean_value := (#Motor[1].power + #Motor[2].power) /2; 


Fig. 10.15 Example of math functions with SCL 
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10.5.5 Conversion functions 


The conversion functions convert the data formats of tags and expressions. 


A detailed description of the conversion functions - including a description of 
implicit conversion - is provided in Chapter 13.6 “Conversion functions” on page 
531. Table 10.8 shows the (explicit) conversion functions available with SCL. 


Table 10.8 Conversion functions with SCL 


Operation | Operand Function 


CONVERT Data type conversion 
ROUND Data type conversion from REAL to DINT with rounding to the next integer 
TRUNC Data type conversion from REAL to DINT without rounding 


The program elements catalog contains the conversion functions under Basic 
instructions > Basic instructions > Conversion operations. 


When inserting the CONVERT function, the data types involved in the conversion 
are selected in a dialog box (Fig. 10.16). 


Source type: 


BOOL 
BYTE mi 
CHAR 
DATE 
DINT 
DWORD 
INT 
REAL 
lag Fig. 10.16 

TOD E | Selection of data types with 


WORD mM the CONVERT function 


til 


Table 10.9 shows the data type conversions possible with SCL. There are also the 
conversions WORD_TO BLOCK _DB and BLOCK _DB_TO WORD. If the permissible 
numerical range is left during a conversion, the ENO tag is set to FALSE, and the 
result of the conversion is invalid. 


Fig. 10.17 shows an example of the conversion functions. A measured value present 
in data format INT is first expanded to the data format DINT and then converted in- 
to the 7-decade BCD format. 


#Measurement_ display := 
DINT_TO BCD DWORD(INT_TO DINT(#Measurement_temperature) ); 


Fig. 10.17 Example of conversion functions with SCL 
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Table 10.9 Data type conversion with SCL 


= = 2 Fs = S m 
mom |3|5/2| 8/8) 2| 8) 2/8] 5] 8 g 
BOOL X xX Xx K K 
BYTE X xX X K K 
WORD X X X X K 
DWORD X Xx xX K X XX 
INT K K xX K X X 
DINT K K K xX xX Xx xX xX B 
REAL XX X XR 
TIME X T 
SSTIME ‘li 
DT T1) T 
TOD X 
DATE X 
CHAR X xX X 
STRING S S S xX 
BCD16 B 
BCD32 B 
Data type conversion is possible: X With CONVERT 

S With S_CONV (integrated in CONVERT) 
T — With T_CONV (integrated in CONVERT) 1) Conversion of DT to 


10.5.6 Shift functions 


day of week 
B_ The BCD data types are handled like WORD or DWORD 
(example: BCD16 = WORD_BCD) 
R= ROUND, TRUNC 
K By combination of two conversions 
(example: BOOL_TO_INT = WORD_TO_INT(BOOL_TO_WORD) 
XX The content of the tag (the value) is not converted! 


A shift function shifts the content of a tag bit-by-bit to the left or right. 


A detailed description of the shift functions is provided in Chapter 13.7 “Shift func- 


tions” on page 544. Table 10.10 shows the shift functions available with SCL. 


The program elements catalog contains the shift functions under Basic instruc- 


tions > Shift and rotate 


In Fig. 10.18, the three decades of two numbers present in BCD format of a SIMATIC 
counter are joined. The more significant component #Quantity_high is shifted to the 
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Table 10.10 Shift functions with SCL 


Operation Data types IN Data type N Function 

SHR (IN, N) BYTE, WORD, DWORD INT, DINT Shift to right 
SHL (IN, N) BYTE, WORD, DWORD INT, DINT Shift to left 
ROR (IN, N) BYTE, WORD, DWORD INT, DINT Rotate to right 
ROL (IN, N) BYTE, WORD, DWORD INT, DINT Rotate to left 


left by three decades (12 bits) and linked to the less significant component #Quan- 
tity_low according to an OR logic operation. In the result #Quantity_display, the two 
times three decades are then present as a 6-decade BCD number. 


#Quantity display := 
SHL(IN := #Quantity high, N := 12) OR #Quantity low; 


Fig. 10.18 Example of shift functions with SCL 


10.5.7 Word logic operations, logic expression 


The word logic operations apply the binary operations AND, OR, and XOR to each 
bit of a word or doubleword. 


A detailed description of the word logic operations is provided in Chapter 13.8.1 “Word 
logic operations” on page 549. Table 10.11 shows the word logic operations available 
with SCL. 


Table 10.11 Word logic operations with SCL 


Operation Operand data types Function 

AND, & BOOL, BYTE, WORD, DWORD AND logic operation 

OR BOOL, BYTE, WORD, DWORD OR logic operation 

XOR BOOL, BYTE, WORD, DWORD Exclusive OR logic operation 
NOT BOOL, BYTE, WORD, DWORD Negation 


Fig. 10.19 shows how you can program 32 edge evaluations simultaneously for ris- 
ing and falling edges. The message bits are collected in a doubleword Messages, 
which is present in data block “Data.SCL”. The edge trigger flags Messages_EM are 
also present in this data block. If the two doublewords are linked by an XOR logic 
operation, the result is a doubleword in which each set bit represents a different 
assignment of Messages and Messages_EM, in other words: the associated message 
bit has changed. In order to obtain the positive signal edges, the changes are linked 
to the messages by an AND logic operation. The bit is set for a rising signal edge 
wherever the message has a “1” and the change a “1”. This corresponds to the pulse 
flag of the edge evaluation. If you do the same with the negated message bits - 
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#Message changes := 

“Data.SCL”.Messages XOR “Data.SCL” .Messages EM; 
“Data.SCL”.Messages pos := 

#Message_ changes AND “Data.SCL”.Messages; 
“Dero. SCL” Messages nee s= 

#Message changes AND “Data.SCL”.Messages; 
NPDES SCL” WeSseees HM g= “peice. SCN” Miessecios 7 


Fig. 10.19 Example of word logic operations with SCL 


the message bits with signal state “0” are now “1” — you obtain the pulse flags for a 
falling edge. At the end it is only necessary for the edge trigger flags to track the 
messages. 


10.6 Controlling the program flow with SCL 


You can influence processing of the user program by means of the program flow 
control functions. You can recognize errors in program execution by using the ENO 
tag, the control statements permit you to implement program branches, and the 
block functions allow you to call and terminate blocks. 


10.6.1 Working with the ENO tag 


The programming language SCL offers a pre-defined tag named ENO with data type 
BOOL, i.e. ENO is not declared by the user but is always present. This block-local tag 
shows FALSE to indicate an error in process execution in an SCL block. 


In order to use automatic error detection with the ENO tag, the block attribute 
Set ENO automatically must be activated. When compiling the block, additional 
code is generated for controlling ENO. You activate the block attribute Set ENO auto- 
matically in the properties of the SCL block under Attributes. 


Error analysis with ENO 


At the block start, the ENO tag is always TRUE. ENO is set to FALSE if a called block 
signals an error or following faulty execution of an arithmetic expression or con- 
version function. Every error in the further block program also sets ENO to FALSE: 
ENO is used as a group error message for program execution in a block. 


You can scan the ENO tag at any time: 


#Total := #Total + #New_ value; 

IF NOT ENO //Scan ENO 
THEN (* faulty addition *); 

END_IF; 


In this program, the THEN branch is even executed if faulty program execution took 
place prior to the addition which ENO also set to FALSE. 
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You can assign a value to the ENO tag at any time. If you only wish to check the cor- 
rect execution of the addition (always assuming that a block attribute Set ENO au- 
tomatically is activated), you can also program: 


ENO := TRUE; //Set ENO 
#Total := #Total + #New_ value; 
IF ENO //Scan ENO 


THEN (* no error occurred *); 
ELSE (* faulty addition *); 
END_IF; 


You can also use the ENO tag independent of the block attribute Set ENO automati- 
cally, for example as a group error message: 


IF (* error detected *) 
THEN ENO := FALSE; RETURN; //Reset ENO and exit block 
END _IF; 


When exiting the block, the value of the ENO tag is automatically assigned to the 
enable output ENO of the block. 


Error evaluation following a block call 


A block call can control the ENO tag via the enable output ENO. If the enable output 
is FALSE (this is the case if an error has occurred in the called block or if the ENO tag 
has been set to FALSE in the called block by the user), the “block-local” ENO tag is 
also set to FALSE in the current block. 


“Block” (Inl := ..., In2 := ...); 
IF NOT ENO THEN (* an error has occurred up to here *); 
END_IF; 


An error signaled by the called block - as well as previous errors — sets the “block- 
local” ENO tag to FALSE. If you wish to scan an error signal by the called block inde- 
pendent of a previous error, use the enable output ENO: 


“Block” (Inl := ..., In2 := ..., ENO => #Okay); 
IF NOT #Okay THEN (* error in block *); END IF; 


The “block-local” ENO tag is not set to FALSE if the called block has not been pro- 
cessed via the enable input EN (with EN equal to FALSE). 


10.6.2 EN/ENO mechanism with SCL 


The EN/ENO mechanism is based on the enable input EN and enable output ENO. 
EN and ENO are implicitly defined parameters with a block call. EN is permissible 
for function blocks (FB) and system function blocks (SFB), ENO for all block types 
which can be called. EN and ENO are not displayed by the program editor in the of- 
fered template. 


EN is the first parameter in the parameter list, ENO the last. Use of these parameters 
is optional. If you do not require these parameters, simply omit them. 
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The EN/ENO mechanism is only supported in SCL if the block attribute Set ENO 
automatically is activated. 


Enable input EN 


You can control the calling of a block using the enable input EN. If EN is TRUE or not 
used, the called block is processed. If EN is FALSE, the called block is not processed. 
You use the enable input EN in the parameter list like an input parameter: 


“Block” (EN := #Enable, Inl := ..., In2 := ...); 
(* “Block” is only processed if #Enable = TRUE *) 


You can use the enable input to implement a conditional block call, which depends 
on the value of a binary tag or binary expression. 


Enable output ENO 


You can scan the error status of the block using the enable output ENO. If ENO is 
TRUE, processing has been carried out correctly. If FALSE, the ENO output signals 
that an error is present in the block. You can scan the state of the ENO output in the 
parameter list using a tag: 


“Block” (Inl := ..., In2 := ..., ENO => #Okay); 


(* With error-free processing, #Okay has the value TRUE *) 
If the called block signals an error, this is transferred to the “block-local” ENO tag: 


“Block” (Inl := ..., In2 := ..., ENO => #Okay); 
#No_error := ENO; 


IF NOT #Okay THEN (* error in block *); END IF; 
IF NOT #No_error THEN (* group error message *); END_IF; 


The #Okay tag is FALSE if block processing was faulty. The #No_error tag is FALSE if 
block processing was faulty or if an error was already present prior to the block call. 


If a function block with EN = FALSE is not processed, this has no influence on the 
“block-local” ENO tag. However, the ENO output is set to FALSE. 


“Block” (EN := #Enable, ..., ENO => #Okay); 
#No_error := ENO; 


If the #Enable tag is FALSE, the #Okay tag is FALSE and the #No_error tag remains 
uninfluenced at its “old” value. 


If you wish to use the EN/ENO mechanism as with LAD or FBD, in other words the 
“series connection” of block calls, you can program as follows: 


“Blockl” (EN := #Enable, ..., ENO => #Okay); 
“Block2” (EN := #Okay, ... ); 


“Block2” is not processed if #Enable is FALSE or if an error has occurred in “Block1”. 
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Fig. 10.20 provides a summary of how the enable output ENO and the ENO tag are 


controlled with a block call. 


Is EN used? 

YES NO 

Is EN = TRUE? Block/function being processed 
YES NO 


Block/function being processed 


Block/function not 
being processed 


Has an error occurred? Has an error occurred? 

YES NO YES NO 

Tag at the Tag at the Tag at the Tag at the Tag at the 

ENO outputissetto | ENO outputissetto | ENO outputissetto | ENO outputissetto | ENO output is set to 
FALSE TRUE FALSE FALSE TRUE 

“Block-local” “Block-local” “Block-local” “Block-local” “Block-local” 

ENO tag is set to ENO tag remains ENO tag remains ENO tag is set to ENO tag remains 
FALSE unchanged unchanged FALSE unchanged 


Fig. 10.20 Schematic for setting of enable output ENO and the ENO tag 


10.6.3 Control statements 


The control statements control program branches and loops depending on a condi- 
tion. The following control statements are used with SCL: 


exceeded. 


IF statement 


IF Program branch depending on BOOL value 
CASE Program branch depending on INT value 
FOR Program loop with a loop-control tag 
WHILE Program loop with a feasibility condition 
REPEAT Program loop with an abort condition 
CONTINUE Abort current loop 

EXIT Leave the program loop 


Note: Make sure when using program loops that the cycle monitoring time is not 


The IF statement processes a statement block depending on a Boolean value (Fig. 


10.21). 


Example: If the #Actual_value tag is greater than the #Setpoint tag, the statements 
following THEN are processed. Otherwise the comparison for #Actual_value less 
than #Setpoint is carried out and, if fulfilled, processing of the statements following 
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Control statement IF 


The contro] statement IF processes a program section <Statements> depending on a Boolean 
value <Condition>. <Condition> can be a binary tag or an expression with a Boolean result. 


Simple IF branch 


IF <Condition> 
THEN <Statements>; 


If <Condition> has the value TRUE, the instruction 
block following THEN is then processed. 


IF <Conditionl> 
THEN <Statements>; 


END IF; If <Condition> has the value FALSE, processing of 
a the program is continued following END_IF. 
IF 
<Condition> 
THEN 
Statements 
END_IF 
IF branch with ELSE 
IF <Condition> If <Condition> has the value TRUE, the instruction 
THEN <Statements>; block following THEN is then processed. 
ELSE <Statements>; If <Condition> has the value FALSE, the instruction 
END_IF; block following ELSE is then processed. 
|rF 
<Condition> 
lense THEN 
Statements Statements 
END_IF 
Cascaded IF branch 


A further condition is scanned by ELSIF ... THEN if 
the preceding condition is not fulfilled. 


ELSIF <Condition2> The ELSIF ... THEN statement can be inserted 
THEN <Statements>; cascaded: An ELSIF scan can again follow 
ELSE <Statements>; ELSIF ... THEN. 
END_IF; ELSE and the subsequent statements can also be 
omitted. 
IF 
<Conditionl> 
ELSE THEN 
Statements Statements 
ELSIF 
<Condition2> 
THEN 
statements 
AND Teel EEO —— 


Fig. 10.21 Principle of operation of the IF branch 
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ELSIF is carried out. If neither of the two comparisons is fulfilled, the statements 
following ELSE are processed. 


#greater than := FALSE; #less_ than := FALSE; #equal_to := FALSE; 
IF #Actual_value > #Setpoint 
THEN #greater_ than := TRUE; 
ELSIF #Actual_value < #Setpoint 
THEN #less_ than := TRUE; 
ELSE #equal_to := TRUE; 
END_IF; 


CASE statement 


You can use the CASE statement to process one or more sequences of statements 
depending on an INT value (Fig. 10.22). 


Control statement CASE 


The control statement CASE processes a program section <Statements> depending on whether an 
integer value <Selection > is within a <Range>. <Range> can be a constant, a fixed range, or a list of 
constants and fixed ranges. 


CASE <Selection> OF 
<Rangel> : <Statements1>; 
<Range2> : <Statements2>; 


ELSE : <Statements0>; 


END_ CASE; 
CASE 
<Selection> 
ELSE <Rangel> <Range2> Meets 
Statements0 Statementsl Statements2 
; | | | 
END_CASE 


Fig. 10.22 Principle of operation of the CASE branch 


Selection is an operand or expression with data type INT. If Selection has the value 
of Range1, the Statements1 are processed and then processing of the program is 
continued following END_CASE. If Selection has the value of Range2, the State- 
ments2 are processed, etc. 


If no value corresponding to the selection is present in the list of values, the State- 
mentsO following ELSE are processed. The ELSE branch can also be omitted. 


The list of values with Range1, Range2, etc. consists of INT constants. 
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Various expressions are possible for a component in the list of values: 
> Asingle INT number 

> Arange of INT numbers (e.g. 15..20) 

> A list of INT numbers and INT numerical ranges (e.g. 21,25,30..33) 
Each value must only be present once in the list of values. 


CASE statements can be nested. A CASE statement can be present instead of a state- 
ment block in the selection table of a CASE statement. 


Example: A value is assigned to the #Error_number tag depending on the assign- 
ment of the #ID tag. 


CASE ID OF 

0 : #Error number := 0; 

1,3,5 : #Error number := #ID + 128; 
6..10 : #Error number := #ID; 

ELSE #Error number := 16#7F; 

END CASE; 

FOR statement 


Using the FOR statement, a program loop is repeatedly processed as long as a con- 
trol tag is within a defined range of values (Fig. 10.23). 


A <Start value> is assigned to the #Control_tag in the start assignment. You define 
the control tag yourself; it must be a tag with data type INT or DINT. <Start value> 
is any INT or DINT expression, as are <End value> and <Increment>. 


Control statement FOR 


The control statement FOR processes a program section <Statements> for as long as a #Control_tag 
is within a range of values. The range of values is defined by a <Start value>, an <Increment>, 
and an <End value>. 
FOR #Control_tag := <Start value> TO <End value> 
BY <Increment> DO <Statements>; 
END FOR; 
FOR 
Control_tag := 
Start value 
¢ 
M C I 
Control_tag <= DO ontrol_tag := = 
End vane > Statements —— Control_tag + increment 
END_FOR 


Fig. 10.23 Principle of operation of the FOR loop 
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#Control_tag if set to the start value at the beginning of loop processing. The end 
value and increment are calculated at the same time and “frozen” (a change in these 
values during loop processing has no effect on the processing of the loop). The 
abort condition is subsequently scanned and - if it is not fulfilled - the program 
loop is processed. 


Each time the loop is executed, #Control_tag is increased by one increment (with 
positive increment) or decreased by one increment (with negative increment). 
Specification of BY Increment can be omitted; +1 is then used as the increment. If 
#Loop-control tag is outside the range of start value and end value, program execu- 
tion is continued following END_FOR. 


The last execution of the loop is carried out with the end value or with the value 
<End value> minus <Increment> if the end value is not reached exactly. Following 
a completely executed program loop, the loop-control tag has the value of the last 
loop plus <Increment>. 


FOR loops can be nested: Further FOR loops with other loop-control tags can be pro- 
grammed within the FOR loop. The current program execution can be aborted in 
the FOR loop using CONTINUE; EXIT terminates the complete FOR loop processing. 


Example: The values of the I/O words %IW128:P to %IW142:P are transferred to the 
memory words %MW160 to %MW174. 


FOR #i := 128 TO 142 BY 2 DO 
MW(#i + 32) := IW(#i):P; 
END FOR; 


WHILE statement 


The WHILE statement is used to repeatedly process a program loop for as long as a 
feasibility condition is fulfilled (Fig. 10.24). 


Control statement WHILE 


The control statement WHILE processes a program section <Statements> for as long as a <Condition> 
is fulfilled. <Condition> is a binary tag or an expression with binary result. 


WHILE <Condition> 
DO <Statements>; 
END WHILE; 


WHILE 
¢ 


Condition ? 


DO 


Statements — 


| enD_warzE 


Fig. 10.24 Principle of operation of the WHILE loop 
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<Condition> is an operand or expression with data type BOOL. The statements 
following DO are repeatedly processed for as long as <Condition> is TRUE. 


<Condition> is scanned prior to each loop processing. If the value is FALSE, 
program execution is continued following END_WHILE. This can also already be the 
case prior to the first loop (the statements in the program loop are not processed in 
this case). 


WHILE loops can be nested: Further WHILE loops can be programmed within a 
WHILE loop. 


The current program execution can be aborted in the WHILE loop using CONTINUE; 
EXIT terminates the complete WHILE loop processing. 


Example: A search is carried out for the bit pattern 16#FFFF in the data block 
%DB10: Data word %DWO contains either the value 16#FFFF or the interval to the 
next data word in which 16#FFFF or again the interval to the next data word could 
be present. The #k tag indicates how often the scan has been executed. 


#i := 0; #k := 0; 


WHILE NOT (DB10.DW(#i) = 16#FFFF) DO 

#i := #i + WORD TO INT(DB10.DW(#i)); #k := #k + 1; 
END WHILE; 
REPEAT statement 


The REPEAT statement is used to repeatedly process a program loop for as long as 
an abort condition is not fulfilled (Fig. 10.25). 


Control statement REPEAT 


The control statement REPEAT processes a program section <Statements> for as long as a <Condition> 
is not fulfilled. <Condition> is a binary tag or an expression with binary result. 


REPEAT 
<Statements>; 
UNTIL <Condition>; 


END REPEAT; 
REPEAT 
<—_——______—_—_ 
Vv 
Statements 
UNTIL 
ai No 
Condition ? 
END REPEAT 


Fig. 10.25 Principle of operation of the REPEAT control statement 
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<Condition> is an operand or expression with data type BOOL. The statements 
following REPEAT are repeatedly processed for as long as <Condition> is FALSE. 
<Condition> is scanned after each loop processing. If the value is TRUE, program ex- 
ecution is continued following END_REPEAT. The program loop is executed at least 
once, even if the abort condition is fulfilled right from the start. 


REPEAT loops can be nested: Further REPEAT loops can be programmed within a 
REPEAT loop. 


The current program execution can be aborted in the REPEAT loop using CONTINUE; 
EXIT terminates the complete REPEAT loop processing. 


Example: The system block D_ACT_DP is repeatedly called in the startup program 
until the respective station is activated. 


REPEAT 
#SFC_ERROR := D_ACT DP(REQ := TRUE, ..., BUSY := #t bool); 

UNTIL NOT #t_bool 

END_ REPEAT; 


CONTINUE statement 


CONTINUE finishes the current program execution in a FOR, WHILE or REPEAT loop 
(Fig. 10.26). 


Following execution of CONTINUE, the conditions for continuation of the program 
loop are scanned (with WHILE and REPEAT) or the loop-control tag is changed by the 
increment and checked whether it is still in the control range. If the conditions are 
fulfilled, execution of the next loop starts following CONTINUE. 


CONTINUE results in abortion of execution of the loop which directly surrounds the 
CONTINUE statement. 


Example: Memory bits are set by two nested FOR loops. If the byte address (#i) is 
equal to zero and if the bit address (#k) is less than 2, the subsequent statements of 
the inner FOR loop are not processed (setting commences with the memory bit 
%MO.2). 


FOR #i := 0 TO 2 DO 
FOR #k := 0 TO 7 DO 
IF (#i = 0 & #k < 2) THEN CONTINUE; END_IF; 
MX (#i,#k) := TRUE; 
END FOR; 
END_ FOR; 


EXIT statement 


EXIT leaves a FOR, WHILE, or REPEAT loop at any position independent of condi- 
tions. Loop processing is aborted immediately and the program following END_- 
FOR, END_WHILE, or END_REPEAT is processed (Fig. 10.27). 
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Control statement CONTINUE 


The control statement CONTINUE finishes the current execution of a FOR, WHILE or REPEAT program 
loop. CONTINUE can be positioned anywhere in the instruction part of the loop. 


Finish execution of a FOR loop 


FOR 


Loop-control variable >= 


End value ? 
DO 
Statements 
IF CONTINUE 
Statements 
END_FOR 


Finish execution of a WHILE loop 


WHILE 
Condition ? —_ 
DO 
Statements 
iF CONTINUE 
Statements 
END WHILE 


Finish execution of a REPEAT loop 


REPEAT 
<—______—__ 


Statements 
IF CONTINUE = 


Statements 


| 


UNTIL 
No 


Condition ? 


END REPEAT 


CONTINUE usually depends ona 
condition. This condition has the data 
type BOOL and can be a tag or an 
expression. 


For the statement sequence: 


IF <Condition> 
THEN CONTINUE; 
END_IF; 


the following is present in 
the representations: 


IF CONTINUE 


Fig. 10.26 Principle of operation of the CONTINUE control statement 
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Control statement EXIT 


The control statement EXIT finishes a FOR, WHILE or REPEAT program loop. 
EXIT can be positioned anywhere in the instruction part of the loop. 


Cancel a FOR loop EXIT usually depends on a condition. 
This condition has the data type BOOL 


FOR and can be a tag or an expression. 


liefae @antaal MES For the statement sequence: 


End value ? 86 IF <Condition> 
THEN EXIT; 
Statements END_ IF; 
IF EXIT the following is present in 
the representations: 
Statements 
IDI dy-CiEak 
END_FOR 
Cancel a WHILE loop 
WHILE 
Vv 
Condition ? —_ 
DO 
Statements 
\—_—_ TREE SE Xeas 
Statements 
END WHILE 
Cancel a REPEAT loop 
REPEAT 


Statements 


ple Ee iex@ lea 


Statements 


UNTIL 
Condition ? 


It 
END REPEAT 


Fig. 10.27 Principle of operation of the EXIT control statement 
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EXIT results in leaving of the loop which directly surrounds the EXIT statement. 


Example: Memory bits are set by two nested FOR loops. If the byte address (#i) is 
equal to 2 and if the bit address (#k) is greater than 5, processing of the inner FOR 
loop is aborted (setting ends with the memory bit %M2.5). 


FOR #i := 0 TO 2 DO 
FOR #k := 0 TO 7 DO 
IF (#i = 2 & #k > 5) THEN EXIT; END_IF; 
MX (#i,#k) := TRUE; 
END FOR; 
END_FOR; 


In the example, processing of the FOR loop with the loop-control tag #k is aborted 
upon EXIT. Processing of the outer FOR loop with the loop-control tag #i is not 
influenced by this. However, the example is designed such that the EXIT statement 
becomes effective in the last execution of the “i-loop”. 


10.6.4 Block functions 


The block functions call and terminate blocks. A detailed description of the block 
functions is provided in Chapter 14.4 “Calling of code blocks” on page 576. 
Fig. 10.28 shows an example of the block functions with SCL. 


//Block call FC without function value 


"Adder.SCL"(Number_1 := #Measurements[1], 
Number 2 := #Measurements [2], 
Number 3 := #Measurements [3], 


Total => #Results[1]); 


//Block call FC with function value 

#Results[2] := "Adder2.SCL"(Number_1 := #Measurements[1], 
#Measurements[2], 
#Measurements[3]); 


Number 2 


Number 3 : 


//Block call FB as single instance 


"DB Adder" (Valuel := # Interval[1], 
Value2 := #Interval[2], 
Value3 := #Interval[3], 
Result => #Position[1]); 


//Block call FB as local instance 


#Result (Valuel := nterval[4], 
Value2 := nterval[5], 
Value3 := nterval[6], 
Result => #Position[2]); 


//Example of supplying parameters with values 


#Results[4] := Results[3] + 
LIMIT (MN := #Lower limit + #Hysteresis, 
TUN = IRV) GO) WINN (Gistsiswbulliic sixvetsipulic)} 
IMPS B= GlUjojerese Ihaliabie)) 2 


Fig. 10.28 Examples of block functions with SCL 
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When calling, an SFC system function is handled like an FC function, and an SFB 
system function block like an FB function block. 


Terminate block with RETURN 
The RETURN statement terminates processing in the current block. 


The program elements catalog contains RETURN under Basic instructions > Program 
control operations. 


Example: The block is left if the ENO tag signals an error (is then FALSE). 


IF NOT ENO THEN RETURN; 
END_IF; 


Call FC block without function value 


When calling an FC function, the name of the function is followed by the parameter 
list in parentheses. All parameters must be supplied with values (first example in 
Fig. 10.28). 


Call FC block with function value 


An FC function with function value can be used like a tag with the data type of the 
function value, for example in an expression. The parameters of the function 
follow the function name in parentheses and must all be supplied with values. In 
the second example in Fig. 10.28, the function value of the “Adder2.SCL” function is 
assigned to the #Results/2] tag. 


Call FB function block as single instance 


When calling a function block as a single instance, the name of the instance data 
block is specified. This is followed by the parameter list in parentheses. Not all 
parameters have to be supplied with values for a function block. You simply omit 
the parameters which are not supplied from the list. 


The function block “Adder” is called in the third example in Fig. 10.28. The data of 
the call is present in the instance data block #Result. 


Call FB function block as local instance 


When calling a function block as local instance, the instance name of the function 
block call is followed by the parameter list in parentheses. Not all parameters have 
to be supplied with values for a function block. You simply omit the parameters 
which are not supplied from the list. 


The function block “Adder” is called in the penultimate example in Fig. 10.28. The 
data of the call is present in the instance data block of the calling function block and 
has the name “DB Adder”. 


429 


10 Structured Control Language SCL 


Supplying the block parameters 


The input parameters on blocks and functions can be constants, tags, and expres- 
sions. 


In the last example in Fig. 10.28, the #Results[4] tag is assigned a total made up of 
the #Results[3] tag and the function value (return value) of the standard function 
LIMIT. In this case a function with a function value is used within an arithmetic 
expression. 


The value to be limited by LIMIT is the output parameter of the local instance 
#Result from the example above this one. It is addressed by #Result.Result and has 
the data type REAL. A conversion from REAL to INT must therefore still take place at 
the IN parameter which expects the data type INT. 


The total of #Lower_limit and #Hysteresis is output as the minimum at the MN 
parameter. 
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11 S7-GRAPH sequential control 


11.1 Introduction 


11.1.1 What is a sequential control? 


Static assignment of the input signals to the outputs (as with logic controls) does 
not dominate in the case of sequential controls, but their time sequence. The con- 
trol procedures executed in succession are divided into sequence steps, or steps for 
short. A step contains one or more actions such as switch motor on or off. Only the 
actions of an active (processed) step are carried out. Progression to the next step is 
carried out by means of transitions (step enabling conditions). The transition can 
be process-dependent, e.g. as a result of signals from the controlled machine or 
plant, or time-dependent, e.g. following expiry of a delay time. 


Project400 * Examptes400 [CPU 412-2 PN] > Program blocks * Examples.GRAPY * MillingMechine [F652] 


PEH ARS aaGAtee & Salcigtw COD 4 
Navigation $2: Orivet_on 
? Permanent pre-instructions... Swaitchon of emilling dire, claenpeng pg. end fan 

Sequences (1) 

y TMi cutevts 


rrterhock 


| 4c» fetertock Event Qualifies 


> $ : Settwot 
aed 1 1 4 « pide 

i $ $ Settot 
as pmtion_nee > s! $ Setwo? 


4 
dime 1 ieee ed news 
i 


thetong 


2 Permanent post-instruction. 
> Alarms < i] > 


Fig. 11.1 Example of representation of a step in a sequencer 


431 


11 S7-GRAPH sequential control 


A sequential control is started at an initialization step; several can be present in a 
sequential control. These are followed by alternate transitions and steps in a linear 
sequencer. Branches are also possible in addition to the linear progression where a 
step is followed by a single step: With alternative branching (OR branch), only one 
of the following partial sequences is processed, with simultaneous branching 
(AND branch), all following partial sequences are processed. 


A sequential control can contain several independent sequencers. 


Fig. 11.1 shows an example of the working window of the GRAPH editor. The se- 
quencer is shown in the GRAPH navigation on the left side and the working area 
shows the step S2 with the transition T2 as selected in the navigation. 


11.1.2 Properties of a sequential control 


A sequential control consists of a function block GRAPH and a data block 
GRAPH_DB. The function block controls the sequencer; the data block is the in- 
stance data block of the sequencer FB and contains the structure of the sequencer 
and the associated data (Fig. 11.2). 


The function block first processes the permanent instructions which precede the 
sequencers and are processed in each cycle. The active sequence steps (of which 
there can be several) and the following transitions are subsequently processed. The 
series-connected permanent instructions are processed following the sequencers. 


Sequence control in user program 


Function block GRAPH <—» Data block GRAPH DB 
> iteennanen: Function block interface 
Call in cyclic pre-instructions 
processing Adjustable: 
; * Maximum parameter set 
Sequences ¢ Standard parameter set 
1 
1 
| S1 
Processing of ! +n —-t10 
the permanent v. Status data of 
instructions > 
and the active $2 S10 sequence control 
step or valid 
transition > + T2 +711 Adjustable data structure: 
t 
* Standard 
! ¢ Minimized memory 
\ S3 
1 —- T3 
i 
v 
Permanent 
post-instructions 
<4 


Fig. 11.2 Components and properties of a sequential control 
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11.1 Introduction 


The instance data block contains the interface of the function block and the status 
data for the sequential control. In the main menu you can select between two pa- 
rameter sets under Options > Settings and PLC programming > GRAPH: If the 
Maximum interface parameters option is activated, all parameters are displayed; if 
the option is deactivated, only the standard parameter set is displayed. You can 
manually add individual input or output parameters to the interface at any time. 


You set the structure of the instance data block in the properties of the function 
block by using the block attribute Create minimized DB. If the attribute is not acti- 
vated, the data is stored successively in the data block (“classical” version, high 
memory requirements!). This provides the advantage that all block-local tags - 
unless they control the internal sequence - can be addressed. When using a data 
block with minimized memory requirements, access to block-local tags is limited. 


11.1.3 Program for a sequential control, quantity framework 


The GRAPH function block contains the program for a sequential control. You can 
program any function block using GRAPH, and also several ones - each with their 
own sequential control - in a user program. 


The instance data block of aGRAPH function block contains the structure data of the 
sequential control. 


> Itcan accommodate up to 250 steps and transitions. (One step and one transition 
are only handled as a pair here.) 


> Up to 249 simultaneous branches are possible. 


> Upto 125 alternative branches are possible. 


The structure of a sequential control is defined during configuration. A sequential 
control can contain several sequencers within the scope of the quantity framework 
specified above. Limitation of the quantity framework, especially for the simultane- 
ous branches, may be meaningful for runtime reasons. 


11.1.4 Operating modes 


The GRAPH sequential control allows the following operating modes: 


> In automatic mode, a switch is made from one sequence step to the next when 
the transition between them is fulfilled. 


> Insemiautomatic mode (“jogging”), aswitch is only made to the next step if the 
transition is fulfilled and a manual transition signal is present. 


> In automatic or semiautomatic mode (“step enabling”), a switch is made to 
the next step if either the transition is fulfilled (as in automatic mode) or a man- 
ual transition signal is present. 


> In manual mode, the steps are selected by means of the step number and acti- 
vated and deactivated individually. 


The operating modes are set in the parameters of the GRAPH function block. 
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11.1.5 Procedure for configuration 


Define control sequences within your user program which can be solved using a se- 
quential control. Itemize the task until you have gained an overview of the number 
and sequence of steps and the required signals. 


First enter the signals which are already specified into the PLC tag table. If the se- 
quential control is a complete block within the user program, it is appropriate to 
create a separate PLC tag table for the sequential control. Signals which are added 
later can be entered in the PLC tag table at any time. 


Create a new function block in the GRAPH language. Enter the structure of the se- 
quencer in the opened block with the steps, transitions, branches, and jumps. At 
least one initialization step must be present at which the sequential control starts, 
and also a sequence end at which processing of the sequence ends. 


If necessary, program the permanent instructions which have to be executed prior 
to and after processing of the sequential control. 


Then enter the actions for each step and the step enabling conditions for each tran- 
sition. You can configure interlocks and supervision times for each step. The ac- 
tions are programmed per step in a list. Each action contains the triggering event, 
the operation, and the tag. 


Ladder logic (LAD) and function block diagram (FBD) can be used as languages for 
programming of interlock, supervision, and transition. The conditions contain the 
binary logic operations in the form of series and parallel connection of contacts (LAD) 
or are in the form of linked boxes with the AND and OR functions (FBD). Comparison 
functions can be used in addition. 


Following programming of the sequential control, it is recommendable to compile 
the function block and to eliminate any errors. You then insert it at the desired po- 
sition in the user program, for example in the main program, and create the in- 
stance data block for the call. 


11.2 Elements of a sequential control 


11.2.1 Steps and transitions 


A sequence step contains the actions (statements, commands) to be executed 
when activating a step, e.g. switch on a drive or call a block. You program the ac- 
tions as a table. A step is identified by a number and/or name (Fig. 11.3). 


You can configure an interlock condition for each sequence step with which the ac- 
tions in the step are controlled. If the step is activated and the interlock condition 
fulfilled, the envisaged action is executed. The action is not executed if the interlock 
condition is not fulfilled. The transition to the next step is independent of the inter- 
lock function. 
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Elements of the programming language GRAPH steps and transitions 


31 Asequential control contains one or more sequencers. A sequencer 
consists of steps (instructions) and transitions (conditions). 
Step 1 A step (Sn) contains the actions to be executed in the form of instructions. 


Theactions of a step are only carried out if the step is "activated". 
T1 Adeactivated step does not execute any actions. A step is activated if 


Transition 1 >the previous transition is fulfilled or 
> when starting the sequencer if it is an initialization step. 
A transition (Tn) contains the step enabling conditions in the form of 


scans and logic operations. The conditions of a transition are only scanned 
if the transition is "valid", i.e. if the previous step is activated. Ifa valid 


$2 
Step 2 
transition is fulfilled, the previous step is deactivated and the following 
T2 program element activated. 
Transition 2 A sequence end terminates a sequencer. A sequence end always follows 
atransition. If the transition is fulfilled, processing of this sequencer 
is terminated. 


Ajump is the transfer from one transition to any step in a sequencer which 
is present in the same sequential control as the jump. 


A jump is always positioned after a transition. If this is fulfilled, the jump is 
Tn made to the specified step, which is then activated. 
The entry pointis always in front ofastep. 
Sm 
Step m 
Tn 
Transition n 
sm 


Fig. 11.3 Steps and transitions 


The actions in a step can be monitored. If the step supervision is fulfilled, i.e. the 
supervision function is triggered, a fault is present which prevents transition to the 
next step and which can be output as an alarm. 


A transition contains the conditions required for progression of the sequencer, e.g. 
the expiry of a timer function or the linking of sensor scans. Ladder logic (LAD) or 
function block diagram (FBD) can be used as the programming languages for the 
step enabling conditions. A transition is identified by a number or name. 


Processing of a sequencer 


You start the processing of a sequential control by calling the GRAPH function 
block. The first step processed when starting a sequential control is the initial step. 
You identify this step when configuring. It need not be the first step in a sequencer. 
It can also be in the middle of a sequencer. 


If the sequential control consists of several independent sequencers, you can define 
initial steps in each sequencer which are activated when starting the sequential 
control. 


The actions in a sequence step are carried out if the step is “active”. The following 
transition is then also “valid” and is processed. If a valid transition is fulfilled, i.e. 
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the step enabling condition has signal state “1”, the previous step is deactivated 
and the step following the transition is activated. 


If the last transition is followed by a sequence end, processing of the sequencer is 
terminated. To restart a sequential control, for example if all sequencers have been 
finished, apply a rising signal edge to the input parameter INIT_SQ of the GRAPH 
function block. 


11.2.2 Jumps in a sequential control 


You can leave linear processing of the steps within a sequencer or between sequenc- 
ers in a sequential control. For example, you can repeatedly process the sequencer 
in a program loop by jumping to a previous step shortly before the end of the se- 
quencer. 


You configure a jump following a transition and the associated jump destination 
prior to astep. The jump is executed if the transition is fulfilled and the step which 
is jumped to is activated. 


Ajump is defined by the number of the transition after which it is configured. The 
jump destination is defined by the number of the step which follows the jump des- 
tination. It is permissible to jump to a destination from more than one position. 


11.2.3. Branching of a sequencer 


A sequencer can contain simultaneous and alternative branches (Fig. 11.4). Simul- 
taneous and alternative branches can be used together in a sequencer. 


With simultaneous branching, all branches are processed in parallel (quasi at the 
same time). A simultaneous branch commences following a transition. Each simul- 
taneous branch commences with a step. If the transition is fulfilled, the first steps 
of each simultaneous branch are processed simultaneously. 


The simultaneous branches are combined following their respective last step. The 
subsequent transition is valid, i.e. it will be processed if the last steps of all com- 
bined simultaneous branches are active (AND condition). 


If a simultaneous branch is finished by a sequence end, this has no influence on the 
rest of the sequencer. 


The division into simultaneous branches and their combination are not mutually 
dependent. You can insert a simultaneous branch at any position and also combine 
a simultaneous branch with the branch on its left at any position. 


With alternative branching, only one of the branches is processed. An alternative 
branch commences following a step. Each alternative branch commences with a 
transition. If the transition is fulfilled, the first step of the respective branch be- 
comes active and the transitions of the other branches become invalid. 


If two or more transitions are fulfilled simultaneously, the step becomes active 
which follows the transition which is on the furthest left. 
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Elements of the programming language GRAPH - branching 


$1 A sequencer can include branching; it is then divided 
into two or more branches. The branches can be 
Step 1 combined together again or finish separately. 
With simultaneous branching, the further branches 
11 are processed simultaneously. A simultaneous 


alternative branch starts and finishes with astep. 


If the previous transition is fulfilled, the first steps of all 
simultaneous branches are activated simultaneously. 


Transition 1 


52 53 If simultaneous branches are combined following their 
respective last step, the last steps of all simultaneous 
Step 2 Step 3 branches must have been activated so that the further 


transition becomes valid (AND condition). 


Asimultaneous branch can also be finished by asequence 
end. The processing in the other simultaneous branches 
is notinfluenced by this. 


T2 
Transition 2 


$1 With alternative branching, only one of the 
further branches (alternative) is processed. An 
Step 1 alternative branch starts and finishes with a transition. 


If the previous step is activated, the first transitions of the 
alternative branches are valid in each case. Only that 
alternative branch is processed whose start transition is 
T3 fulfilled first. If two or more start transitions are fulfilled, 
Transition 3 Only the branch which is on the furthest left of the 
associated branches is processed. 


T1 
Transition 1 


S2 S3 If alternative branches are combined following their 
Step 2 Step 3 


respective last transition, the following program element 
is activated if the transition of the processed branch is 
fulfilled (OR condition). 


T4 An alternative branch can also be finished by a sequence 
Transition 4 endorajump. 


T2 
Transition 2 


Fig. 11.4 Simultaneous and alternative branching 


The alternative branches are combined following their respective last step. If the 
transition of the processed branch is fulfilled, the next (common) step is processed. 
The combination of alternative branches corresponds to an OR condition. 


An alternative branch can be finished by a sequence end or a jump. 


11.2.4 GRAPH-specific tags 


A data structure is created in the static local data for each configured step, for each 
configured transition, and for the sequential control. You can use the components 
of the data structure in the user program. You can read these values at any time. To 
guarantee trouble-free control of the sequencer, a write operation is not advisable. 
Some of these components are described below as examples. 
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Step activation time 


The step activation time is started when activating a step. This delivers two values. 
The value #Step_name.T corresponds to the total duration which has passed since 
activation of the step. The value #Step_name.U contains the fault-free duration, in 
other words the duration from the start of step activation minus the duration for a 
fault triggered by the supervision function. Step_name is the symbolic name of the 
respective step. For example, if the step is named Lower_drill, the step activation 
time is scanned within the GRAPH function block by #Lower_drill.T (total step acti- 
vation time) or #Lower_drill.U (uninterrupted step activation time). The values exist 
in the data type TIME. 


The limits for the step activation time - the step supervision times - are set when 
configuring the sequential control under Options > Settings and PLC programming > 
GRAPH. They apply to all steps. 


GRAPH provides two functions for comparing the step activation time with the step 
supervision times: The CMP>T function has signal state “1” if the current activation 
duration is greater than the configured supervision time. The CMP>U function has 
signal state “1” if the current, fault-free activation duration is greater than the con- 
figured fault-free supervision time. The two functions are represented as compari- 
son functions. 


Step status 


The binary tag #Step_name.S1 has signal state “1” for one processing cycle if the 
step named Step_name is activated. The #Step_name.X tag indicates with signal 
state “1” that the step is activated. The #Step_name.SO tag has signal state “1” for 
one processing cycle if the step is deactivated. 


Transition status 


The binary tag #Transition_name.TV indicates with signal state “1” that the 
transition named Transition_name is valid, i.e. it is being processed. The #Transi- 
tion_name.TT tag indicates with signal state “1” that the transition is fulfilled. The 
#Transition_name.TS tag indicates with signal state “1” that the transition is 
switched. 


11.2.5 Permanent instructions 


Permanent instructions are program components which are processed in every cy- 
cle independent of the status of the sequential control. Permanent pre-statements 
are processed prior to the sequential control, post-statements after the sequential 
control. 


Permanent instructions can be programmed in LAD or FBD. Any number of perma- 
nent instructions can be used. 


For programming, double-click on the permanent instructions in the GRAPH navi- 
gation or click on the Permanent pre-statements or Permanent post-statements sym- 
bol in the toolbar of the working window. 
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11.2.6 Step and transition functions 


You program a step together with the subsequent transition. These are always han- 
dled in pairs. The step can remain empty if no actions are envisaged at the current 
position in the sequencer. The subsequent transition is then valid immediately. It is 
also possible to program an “empty transition” without step enabling conditions. 
This is then fulfilled immediately when processing. 


Fig. 11.5 shows the components of a step/transition pair. With an alternative 
branch, the first transitions of the branches are counted to the previous step. When 
combining a simultaneous branch, the common transition is displayed in each case 
with the last step of a branch. 


Functions in a step/transition pair 


Sequence step 


Interlocking of the step can be programmed in each step. 


Interlock (step interlocking) This interlocking determines whether interlock- 
dependent instructions are prevented or enabled. 
| I] (c) Incoming or outgoing interlocks are events which can be 
scanned. 


— 


Supervision (step monitoring) Supervision of the step can be programmed in each step. 
II This supervision can prevent continuation to the next 
| Il | {v} step, and output a message. 
Incoming or outgoing supervisions are events which can 
| | be scanned. 
Actions 
The control instructions are present in the actions. 
a(9F E Q_  Operand They are executed if the step is active. An instruction 
{© E Q  Operand consists of an operation which is programmed by a code 


letter (qualifier) and an operand. The execution of an in- 


struction may depend on an event and/or the interlocking. 
Interlock Event Statement 


Transition 


If a step is active, the following transition is valid and is 
processed. The transition contains the step enabling 
conditions to the next step. 


| | 
| | If the conditions are fulfilled, the previous step is 
| deactivated and the following step activated. 


| Step 


Step enabling conditions 


Fig. 11.5 Components of a sequence step/transition pair 


Interlock 


An interlock condition is specific to a step. If the interlock condition is fulfilled (this 
is the “good case”), the actions depending on the interlock are carried out for the 
active step. If the interlock condition is not fulfilled, the actions depending on the 
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interlock are not carried out. The change in status of the interlock condition can be 
scanned with events. 


The event L1 means that the interlock condition changes from the “fulfilled” state 
to the “not fulfilled” state (fault coming). Actions dependent on the interlock condi- 
tion are then no longer executed. 


The event LO means that the interlock condition changes from the “not fulfilled” 
state to the “fulfilled” state (fault going). Actions dependent on the interlock condi- 
tion are then executed again. 


The transition to the next step is independent of the state of the interlock condition. 
When deactivating a step, a fulfilled interlock condition is automatically canceled. 


You program an interlock condition as a logic operation in LAD or FBD. You can use 
a maximum of 32 program elements per interlock condition. 


An interlock error is signaled if a non-fulfilled interlock condition occurs. You can 
activate or deactivate the acknowledgment requirement for signaling of the inter- 
lock error. If the acknowledgment requirement is activated, processing of the se- 
quencer is only continued following acknowledgment. 


Supervision 


A monitoring condition specific to a step is referred to as supervision. If the super- 
vision condition is fulfilled, a fault is present which results in a fault signal. A 
non-fulfilled supervision condition is the “good case”. The change in status of the 
supervision condition can be scanned with events. 


The event V1 means that the supervision condition changes from the “not fulfilled” 
state to the “fulfilled” state. A fault is then present. 


The event VO means that the supervision condition changes from the “fulfilled” 
state to the “not fulfilled” state. The fault then goes again. 


In the case of a fulfilled supervision condition, the transition to the next step is 
omitted even if the following transition is fulfilled. The fault-free step activation 
time #Step_name.U is stopped and the complete step activation time #Step_name.T 
continues. 


A fulfilled supervision condition is automatically reset when a step is deactivated (a 
deactivated step cannot be faulty, only activated steps are monitored). Therefore, 
monitoring can only be carried out for actions which are programmed in the asso- 
ciated step. 


You program a supervision condition as a logic operation in LAD or FBD. You can 
use a maximum of 32 program elements per supervision condition. 


A supervision error is signaled when a non-fulfilled supervision condition occurs. 
You can activate or deactivate the acknowledgment requirement for signaling of 
the supervision error. If the acknowledgment requirement is activated, processing 
of the sequencer is only continued following acknowledgment. 
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Actions in general 


An active step uses actions to control operands or tags, to call blocks, or to carry out 
arithmetic operations. An action can consist of the interlock condition, an event, 
and a statement. 


A statement is, for example, the setting of a bit memory using the S operation. The 
statement is S %M12.0 and means: As long as the step is active, the bit memory 
%M12.0 is set to signal state “1” in each processing cycle. 


A statement can be linked to an interlock condition. For this purpose, the statement 
is preceded by the symbol -(C)- (condition). The action is then -(C)- S %M12.0 and 
means: As long as the step is active and as long as the condition is fulfilled, the bit 
memory %M12.0 is set to signal state “1” in each processing cycle. 


A statement can be linked to an event. An event is a change in status, for example 
the activation of the sequence step with the start information S1. The event is 
specified in front of the statement. The action is then S1 S %M12.0 and means: If the 
step is active and if the event - in this case the step activation - occurs, the bit mem- 
ory %M12.0 is set once to signal state “1”. 


Events, interlock conditions, and statements can be combined together. For the ex- 
ample, the action is then -(C)- S1 S %M12.0 and means: The bit memory is set once 
to signal state “1” if the step is activated and the interlock condition is fulfilled at 
the same time. 


If the step does not contain any actions, it is an “empty step” which reacts like an ac- 
tive step. The following transition is then processed immediately. 


Events 


An event controls an action. The change in status of a step, a supervision or an 
interlock condition is used to execute a statement once (Table 11.1). 


The statements provided by the GRAPH programming language in actions, and how 
they can be combined with events, are described in the next Chapter 11.2.7 
“Processing of actions”. 


Table 11.1 Events for actions 


Identifier | Event The action is carried out once if ... 
S1 Incoming step the step is processed for the first time 
so Outgoing step the step is processed for the last time 
V1 Incoming monitoring error the supervision error (fault) occurs 
vo Outgoing monitoring error the supervision error is removed 
L1 Outgoing interlock condition | the interlock condition changes to “not fulfilled” (fault) 
LO Incoming interlock condition | the interlock condition changes to “fulfilled” 
Al Alarm acknowledgement an alarm is acknowledged 
R1 Incoming registration a registration comes 
(rising edge at parameter REG_EF or REG_S) 
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Transitions 


A transition contains the step enabling conditions to the next step. A transition is 
processed (the transition is “valid”) if the previous step is processed (the step is 
“active”). The transition is “fulfilled” if the step enabling condition has signal state 
“1”, The previous active step is then processed for a last time with the event SO (the 
step is “deactivated”) and the following step is processed. The first processing takes 
place with the event S1 (the step is “activated”). 


In the case of simultaneous branching, a transition is followed by two or more steps 
which are all activated in the case of a fulfilled transition. During the combination 
of the simultaneous branching, all last steps of the branches must be active before 
the common transition becomes valid. 


In the case of alternative branching, the first transitions are all valid if the step prior 
to the branch is active. If one of the transitions is fulfilled, the following step is ac- 
tivated. The transitions of the other branches are then no longer valid and therefore 
only one branch is processed. If two or more transitions are fulfilled simultaneous- 
ly, the branch which is on the furthest left is processed. During the combination of 
alternative branching, all last transitions must be fulfilled before the following 
common step is activated. 


Ajump following a transition leads to a step which does not directly follow the tran- 
sition in the graphic representation. This step is activated if the transition is ful- 
filled. 


If a transition is followed by a sequence end, processing of the sequencer is termi- 
nated if the transition is fulfilled. 


If a transition does not contain a step enabling condition, it is an “empty transition”. 
A valid empty transition is fulfilled immediately and activates the following step. 


11.2.7 Processing of actions 


Controlling binary tags 


Tags from the following operand areas can be controlled in a step: inputs I, outputs 
Q, bit memories M, and data DB.DBX. The tags have the data type BOOL and can be 
addressed absolutely or symbolically. 


Table 11.2 shows the possible operations and the permissible combinations with 
interlock condition and events. The first column (Q) contains the qualifier of the op- 
eration. In the case of a statement identified by “-(C)-”, the interlock condition is op- 
tional and can also be omitted. 


The N operation is used to set a binary tag to signal state “1” for as long as the step 
is active and an optional interlock condition is fulfilled. The binary tag is reset to 
signal state “O” when the step is deactivated or with a non-fulfilled interlock condi- 
tion. In association with an event, the operation is executed once in the program 
cycle which follows the event. 
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Table 11.2 Actions for binary tags 


Q 


Interlock 


Ev 


ents 


Execution 


N 


,V1,A1, R1 
, VO, L1, LO 


Set a tag to signal state “1” for as long as the step is active (non-retentive 


assign function) 


In each program cycle 


Single execution in the next program cycle 


Single execution in the next program cycle 


,V1,A1, R1 
, VO, L1, LO 


Set a tag to signal state “1” (set function) 


In each program cyc 


e 


Single execution in the next program cycle 


Single execution in the next program cycle 


Set a tag to signal state “O” (reset function) 


In each program cyc 


e 


-(C)- $1, V1, A1, R1 
- SO, VO, L1, LO 


Single execution in the next program cycle 


Single execution in the next program cycle 


Set a tag with delay (ON delay) 


Set a tag to signal state “1” for a specific period (limited time) 


The S operation is used to set a binary tag (latching) to signal state “1” for as long 
as the step is active and an optional interlock condition is fulfilled. In association 
with an event, the operation is executed once in the program cycle which follows the 
event. 


The R operation is used to reset a binary tag (latching) to signal state “O” for as long 
as the step is active and an optional interlock condition is fulfilled. In association 
with an event, the operation is executed once in the program cycle which follows the 
event. 


The D operation is used to set a binary tag to signal state “1” delayed by a specific 
duration. The duration of the delay is specified in seconds as a constant or PLC tag 
with data type TIME or DWORD. The duration starts when the step is activated and 
the optional interlock condition fulfilled. The binary tag is reset to signal state “0” 
when the step is deactivated or when the optional interlock condition is no longer 
fulfilled. Combination of the D operation with an event is not permissible. The bi- 
nary tag shows the response of an ON delay. 


The L operation is used to set a binary tag to signal state “1” for a specific duration. 
The duration is specified in seconds as a constant or PLC tag with data type TIME or 
DWORD. The duration starts when the step is activated and the optional interlock 
condition fulfilled. The binary tag is reset to signal state “O” when the duration has 
expired, when the step is deactivated, or when the optional interlock condition is no 
longer fulfilled. Combination of the L operation with an event is not permissible. 
The binary tag exhibits a pulse response. 
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Controlling timer functions 


Tags from the operand area “SIMATIC timer functions T” can be controlled ina step. 
The tags have the data type TIMER and can be addressed absolutely or symbolically. 


Table 11.3 shows the possible operations and the permissible combinations with 
interlock condition and events. The first column (Q) contains the qualifier of the op- 
eration. In the case of a statement identified by “-(C)-”, the interlock condition is op- 
tional and can also be omitted. 


Table 11.3 Actions for SIMATIC timer functions 


Q Interlock | Events Execution 
TL -(C)- $1, V1, A1, R1 Start a timer function once as extended pulse 
- So, VO, L1, LO 
TD -(C)- $1, V1, A1, R1 Start a timer function once as retentive ON delay 
- So, VO, L1, LO 
TF - - Start a timer function as OFF delay 
TR -(C)- $1, V1, A1, R1 Stop and reset a timer function once 
- So, VO, L1, LO 
The TL operation starts a SIMATIC timer function as extended pulse. The duration 


is specified as a constant or PLC tag with data type SSTIME or WORD. The operation 
always depends on an event. The timer function is started if the step is activated and 
the event occurs and when - depending on the type of event - the optional interlock 
condition is fulfilled simultaneously. The timer has signal state “1” once the timer 
function has been started and signal state “O” again when the timer function has ex- 
pired. The response of the timer function, which is independent of the further re- 
sponse of the interlock condition and the step activation, is described in Chapter 
12.3.4 “Timer response as extended pulse” on page 484. 


The TD operation starts a SIMATIC timer function as retentive ON delay. The dura- 
tion is specified as a constant or PLC tag with data type SSTIME or WORD. The oper- 
ation always depends on an event. The timer function is started if the step is acti- 
vated and the event occurs and when - depending on the type of event - the option- 
al interlock condition is fulfilled simultaneously. The timer status has signal state 
“1” once the timer function has expired and signal state “O” again when the step is 
deactivated or the interlock condition is no longer fulfilled. The response of the tim- 
er function is described in Chapter 12.3.6 “Timer response as retentive ON delay” 
on page 487. 


The TF operation starts a SIMATIC timer function as OFF delay. The duration is spec- 
ified as a constant or PLC tag with data type SSTIME or WORD. The operation is not 
linked to an event or the interlock condition. The timer function is started when the 
step is deactivated, i.e. left. The timer status is set to signal state “1” by activation 
of the step and reset to signal state “O” when the timer function has expired. The 
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response of the timer function is described in Chapter 12.3.7 “Timer response as 
OFF delay” on page 489. 


The TR operation resets a SIMATIC timer function. The operation always depends 
on an event. The timer function is reset if the step is activated and the event occurs 
and when - depending on the type of event — the optional interlock condition is ful- 
filled simultaneously. The further response of the timer function (the timer status) 
depends on the operating mode in which the timer was started. The response is 
described in Chapters 12.3.4 “Timer response as extended pulse” on page 484, 
12.3.6 “Timer response as retentive ON delay” on page 487, and 12.3.7 “Timer 
response as OFF delay” on page 489. 


Controlling counter functions 


Tags from the operand area “SIMATIC counter functions C” can be controlled in a 
step. The tags have the data type COUNTER and can be addressed absolutely or sym- 
bolically. 


Table 11.4 shows the possible operations and the permissible combinations with 
interlock condition and events. The first column (Q) contains the qualifier of the op- 
eration. In the case of astatement identified by “-(C)-”, the interlock condition is op- 
tional and can also be omitted. 


Table 11.4 Actions for SIMATIC counter functions 


Q Interlock | Events Execution 

CU -(C)- $1, V1, A1, R1 Increment a counter function once by one unit 
- So, VO, L1, LO 

cD -(C)- S1, V1, A1, R1 Decrement a counter function once by one unit 
- So, VO, L1, LO 

CR -(C)- $1, V1, A1, R1 Reset a counter function once 
- So, VO, L1, LO 

cs -(C)- $1, V1, A1, R1 Set a counter function once with a count value 
- So, VO, L1, LO 


The principle of operation of the SIMATIC counter functions used by GRAPH is de- 
scribed in detail in Chapter 12.5 “SIMATIC counter functions” on page 495. 


The CU operation increments the count value of a SIMATIC counter function by one 
unit. The operation always depends on an event. The counter function counts up if 
the step is activated and the event occurs and when - depending on the type of 
event - the optional interlock condition is fulfilled simultaneously. 


The CD operation decrements the count value of a SIMATIC counter function by one 
unit. The operation always depends on an event. The counter function counts down 
if the step is activated and the event occurs and when - depending on the type of 
event - the optional interlock condition is fulfilled simultaneously. 


445 


11 S7-GRAPH sequential control 


The CS operation sets a SIMATIC counter function to a specified count value. The 
count value is specified as a constant or PLC tag with data type WORD. The opera- 
tion always depends on an event. The counter function is set if the step is activated 
and the event occurs and when - depending on the type of event — the optional in- 
terlock condition is fulfilled simultaneously. 


The CR operation resets a SIMATIC counter function to zero. The operation always 
depends on an event. The counter function is reset if the step is activated and the 
event occurs and when - depending on the type of event — the optional interlock 
condition is fulfilled simultaneously. 


Executing program statements 


Program statements, for example block calls, math functions, or conversion func- 
tions, can be executed in a step. 


Table 11.5 shows the permissible combinations of a program statement with inter- 
lock condition and events. The first column (Q) contains the qualifier of the opera- 
tion. In the case of a statement identified by “-(C)-”, the interlock condition is op- 
tional and can also be omitted. 


Table 11.5 Actions for program statement 


Q Interlock | Events Execution 

N Execute program statement 
-(C)- - In each program cycle 
-(C)- $1, V1, A1, R1 Single call in the next program cycle 
- So, VO, L1, LO Single call in the next program cycle 


The N operation executes a program statement for as long as the step is active and 
an optional interlock condition is fulfilled. In association with an event, the pro- 
gram statement is executed once in the program cycle which follows the event. 


All statements which are listed in the task window in the Statements pallet (with the 
exception of the logic operations and comparators in the LAD or FBD folder under 
Basic instructions) are permissible as program statements. Assignments and simple 
arithmetic operations on digital values are permissible in addition. Examples of 
program statements in an action: 


varl := var2 Assignment 

varl := var2 + var3 Simple arithmetic function 

varl := SIN(var2) Math function 

varl := SHL WORD(var2,var3) Shift function 

CALL WAIT Block call, here: system function 
(WT := varl 


) 
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CALL TP TIME, “DB name” Block call, here: IEC timer function 
(IN := varl 
PT := var2 


) 
You can also call self-created blocks: The syntax of a function call is CALL “FC_name” 


(parameter list) and the syntax of a function block call is CALL “FB_name’”, 
“DB_name” (parameter list). 


Activating and deactivating steps 


Further steps can be activated or deactivated in a step. Individual steps are ad- 
dressed symbolically. If all steps are addressed, the operand is named S_ALL. 


Table 11.6 shows the permissible combinations of step activation or deactivation 
with interlock condition and events. The first column (Q) contains the qualifier of 
the operation. In the case of a statement identified by “-(C)-”, the interlock condi- 
tion is optional and can also be omitted. 


Table 11.6 Actions for block calls 


Q Interlock | Events Execution 
ON Activate a different step 
-(C)- $1, V1, A1, R1 Single activation on the occurrence of event 
- So, VO, L1, LO Single activation on the occurrence of event 
OFF Deactivate a different step 
-(C)- $1, V1, A1, R1 Single deactivation on the occurrence of event 
- SO, VO, L1, LO Single deactivation on the occurrence of event 
OFF Deactivate all other steps (with S_ALL operand) 
-(C)- S1,V1 Single deactivation on the occurrence of event 
- L1 Single deactivation on the occurrence of event 


The ON operation in conjunction with a single step activates a step which is not the 
current step. The operation always depends on an event. The other step is activated 
if the current step is activated and the event occurs and - depending on the type of 
event - the optional interlock condition is fulfilled at the same time. 


The OFF operation in conjunction with a single step deactivates a step which is not 
the current step. The operation always depends on an event. The other step is deac- 
tivated if the current step is activated and the event occurs and —- depending on the 
type of event - the optional interlock condition is fulfilled at the same time. 


The OFF operation in conjunction with the S_ALL operand deactivates all other 
steps. The operation always depends on an event. The other steps are deactivated if 
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the current step is activated and the event occurs and - depending on the type of 
event — the optional interlock condition is fulfilled at the same time. 


If a step is both activated and deactivated in a processing cycle, deactivation has pri- 
ority. 


11.3 Configuring a sequential control 


You program a sequential control in the following steps: 


Insert a function block which is to accommodate the sequential control into your 
program. 


Configure the sequencer(s) in the function block. 


Program the actions in the steps and the step enabling conditions in the transi- 
tions. 


Supplement the sequencer by permanent instructions if applicable. 


Compile the function block and generate the associated instance data block. 


Call the function block in the program and test the sequential control. 


The user program can contain several function blocks with different sequential 
controls. 


Basic settings for the sequential control 


Select the Options > Settings command in the main menu and click on GRAPH in the 
PLC programming group. You can then adapt the properties of the sequential con- 
trol. For example, you can set the time monitoring functions for the sequence steps 
here and the properties which are assigned to a new GRAPH function block when 
added, such as selecting the LAD or FBD programming language for the conditions, 
using maximum or standard interface parameters, or creating a “normal” or mem- 
ory-optimized data block. 


11.3.1 Programming the GRAPH function block 


A prerequisite for programming a sequential control is that a project has been cre- 
ated with a PLC station. In the project tree, open the Program blocks folder under 
the PLC station and double-click on Add new block. 


In the Add new block window, select Function block as block type and GRAPH as lan- 
guage. You can select the block number as desired if you activate the Manual option. 
Select a meaningful name for the block which has not already been assigned to an- 
other block, a PLC tag, a symbolically addressed constant, or a PLC data type. If the 
Add new and open checkbox is activated, the new block is incorporated into data 
management by clicking on the OK button and opened for processing with the 
GRAPH editor (Fig. 11.6). 
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Fig. 11.6 Working window of the GRAPH editor 


The working window of the GRAPH editor is divided in two. The left side contains 
the GRAPH navigation with which you can navigate within the sequential control 
(not to be confused with the project tree with which you navigate within the proj- 
ect). The right side contains the working area in which you program the sequential 
control with steps, transitions, and branches. Use of the working window is de- 
scribed in Chapter 6 “Program editor” on page 253. 


11.3.2 Configuring the sequencer structure 


You configure the structure of a sequencer in the sequence view. The sequencer 
structure is displayed when you click on the Sequence view symbol in the toolbar of 
the working window. You can save an incompletely entered sequencer with the proj- 
ect at any time and continue processing later by opening the function block. An in- 
complete sequencer is identified in the navigation by a white cross on ared circle. 


You create a further sequencer within the sequential control using the Insert 
sequence symbol from the toolbar of the working window. In addition to permanent 
instructions, you can also select one of the previously entered sequencers in the 
navigation for processing. 


Creating a sequencer 


With a newly created sequencer, a step and a transition are already positioned in the 
working area. The double arrow underneath the transition indicates that the 
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sequencer is still “open” and has to be completed. Then use the mouse to drag fur- 
ther program elements into the working area from the favorites bar or the program 
elements catalog under Basic instructions and the GRAPH actions folder in order to 
extend the sequencer. Small gray squares in the working area indicate where the se- 
lected program element can be positioned and a green square indicates where it is 
positioned when you “let go”. 


You can remove a selected program element from the working area using the Delete 
command from the shortcut menu. With the mouse you can drag a program ele- 
ment in the sequencer to another (approved) position in the sequencer. All missing 
program elements which are required for the sequencer structure - for example a 
transition between two steps — are indicated by the program editor in red lettering. 


In a linear sequencer, these are followed by alternate transitions and steps. You can 
extend the sequencer using the Step and transition command until the desired num- 
ber of steps has been reached. Then insert a sequence end after the last transition. 


You can program a jump in that you position the Jump to step instruction following 
a transition. The program editor then displays a table with the already programmed 
steps. Then select a step and the jump destination will be automatically inserted 
into the sequencer. 


You program an OR branch using the Alternative branch instruction. You can posi- 
tion this instruction following each step and an alternative branch is then inserted 
with the first transition. Several alternative branches can be opened in parallel. You 
can terminate an alternative branch with a sequence end or with another alternative 
branch or the “main branch” on the far left (use the mouse to drag the double arrow 
at the end of the alternative branch to another partial sequence following a transi- 
tion). 


You program an AND branch using the Simultaneous branch instruction. You can 
position this instruction following each transition and a simultaneous branch is 
then inserted with the first step. Several simultaneous branches can be opened in 
parallel. The Step and transition instruction first inserts the transition in a simulta- 
neous branch (sequentially) and then the next step. You can terminate a simultane- 
ous branch with a sequence end (first insert a single transition following the last 
step) or with another simultaneous branch or the “main branch” on the left (use the 
mouse to drag the double arrow at the end of the simultaneous branch to another 
partial sequence following a step). 


Processing of the sequencer commences with an initial step. You define a step as the 
initial step if you select it in the working window and activate the Initial step option 
in the shortcut menu. This can be any step. Several steps are permissible as initial 
steps within a sequence controller. 


Naming of sequencer, steps, and transitions 


The title of a sequencer is present in the title bar above the working area behind the 
sequencer number. In the case of a newly created sequencer, <new sequence> is 
present here. You can change this name by clicking in the title bar. 
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A sequence step has anumber (e.g. $1) and aname (e.g. Step1). Double-click on the 
step number in order to assign a different number which has not yet been used. 
Double-click on the name to assign a different name to the step. Proceed in the same 
manner for transitions. You can also change the number (e.g. T1) and the name 
(e.g. Trans1) here. 


The GRAPH editor provides support in renumbering steps and transitions. Select a 
step or a transition and then the Renumber... command from the shortcut menu. In 
the displayed window you can select whether you wish to renumber steps and/or 
transitions, the number starting at which this is to be carried out, and whether the 
renumbering is to take place in the complete sequential control (the complete 
block), in the current sequencer, or in the current branch. 


11.3.3. Programming steps and transitions 


In order to program the actions and step enabling conditions, select a step or a tran- 
sition and then Single step view in the toolbar of the working window, or double- 
click on a step or transition. The step and the associated, following transition are 
displayed (Fig. 11.7). In the case of alternative branching, all following transitions 
of the alternative branches are displayed for the step prior to the branch. 


Project400 >» Examples400 [CPU 412-2 PN] > Program blocks >» Examples.GRAPH > MillingMachine [FB52] — =X 


Fexjq SeSaeo axes & Baplarh] Cod = =| 


a 


4e 4/F » + jy MPT CMP>U CONV NEG SWAP 


$2: Drives_on 


Switch-on of milling drive, clamping jig, and fan 
7 Interlock -(c)}-: 3 
» Supervision -(v)-: 


Ve Actions: --- 


ach Interlock Event Qualifier Action 
~(C}- S1 5 -Settol "Milling drive” 
s1 s -Settol "“Tension_valve” 
s1 s -Setto1 “"Blower_motor” 
<Add new> 


~ _T2- Switched on: 


“speedreached" “Workparttensed" “Blower works" 


KIO HK“ hHRe—_— sesssscvevessssvcnsvscccccassesse; Siritchiedon 


Shafting 


[x] i ] [>| 


Fig. 11.7 Example of single step view 
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The single step display consists of four “networks” which you can open and close 
using the Open all networks and Close all networks symbols. Clicking on the small 
triangle on the left of the “Network title” results in the same response. You can 
change the programming language in the networks (with the exception of the 
Actions networks) in the block properties: Select the function block with the se- 
quential control in the project tree and then the Properties command in the shortcut 
menu. Set the language in the networks under Block in the General tab. You can pro- 
vide each network with a heading. 


You program the step interlocks in the Interlock network. Open the network and 
program the logic operation as usual with LAD or FBD. You can find the permissible 
statements (mainly bit logic operations and comparators) in the favorites or in the 
program elements catalog under LAD or FBD. 


You program the step supervision in the Supervision network and the step enabling 
conditions in the Transition network in the same manner as you program the step 
interlocks in the Interlock network. 


The Actions network consists of a table in which you enter the statements to be ex- 
ecuted. You enter the statements in the Qualifier column. Click on <Add new> and 
then select the desired statement from the drop-down list. Specify the associated 
tag or operand in the Action column. You can control the display using the Abso- 
lute/symbolic operands symbol. In the Event column, select the event from a drop- 
down list for which the statement is to be executed. There is a mandatory entry for 
an edge-controlled statement; this is indicated by the <???> string highlighted in 
red. You specify in the Interlock column whether the statement specified in the 
Qualifier column depends on the step interlock. 


Some statements in actions, for example block calls with parameter list, require 
several lines. You add further lines to an action by positioning the cursor in the line 
and activating the Allow multi-line mode option in the shortcut menu. A further line 
is added each time you press the RETURN button in the Action column. 


In addition to the code letter, you can also display the significance of the events and 
qualifiers in the table. Click with the mouse in the table, and activate the Show event 
descriptions and/or Show qualifier descriptions commands in the shortcut menu. 


11.3.4 Programming permanent instructions 


To program permanent instructions, select the Permanent pre-instructions or 
Permanent post-instructions section in the GRAPH navigation. In the navigation, 
click on a network in these statements and the logic operations of the permanent 
instructions will be displayed in the working area. You set the programming lan- 
guage (LAD, FBD) as with single-step programming in the properties of the func- 
tion block. 


You can use the complete LAD/FBD set of statements in the program elements cata- 
log for the permanent instructions. You add an additional network by selecting the 
previous network and then the Insert network command from the shortcut menu. 
Each network can be provided with a heading. 
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11.3.5 Configuring block-independent alarms 


In order to configure block-independent alarms, open the Alarms section in the 
GRAPH navigation, for example using the Alarm view symbol in the toolbar of the 
working window. 


You can activate or deactivate the messages. With the interlock and supervision 
messages, you can activate or deactivate the acknowledgment requirement. You 
make the default settings for this in the main menu using the Options > Settings 
command under PLC programming > GRAPH in the Alarm properties section. 


You can change the standard text “GRAPH7_INTERLOCK_ERROR” or “GRAPH7_ 
SUPERVISION_ FAULT”. 


11.3.6 Attributes of the GRAPH function block 


You set the block attributes in the block properties. Select the GRAPH function 
block in the project tree and then the Properties command from the shortcut menu 
(Fig. 11.8). 


The IEC check attribute indicates how strict the data type test is to be in the code 
block. With the attribute not activated, it is usually sufficient if the tags used have 
the data width required for execution of the function or statement; with the attri- 
bute activated, the data types of the tags must correspond to the required data 


types. 


If the Create minimized DB attribute is activated, the instance data block for the 
GRAPH block is created in minimized format. Despite the advantage of the reduced 
memory requirements, there are a number of limitations. For example, certain el- 
ements of the step and transition structures, messages, and the “Skip steps” option 
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Fig. 11.8 Block attributes for the sequential control 
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are not available, and the step and transition numbers are automatically numbered 
consecutively when compiling. 


Using the Skip steps attribute you allow steps in a sequencer to remain deactivated 
if both transitions before and after the step are fulfilled. The step between these 
transitions is not processed. A switch is made immediately to the next step. 


If the Acknowledgment required for supervision errors attribute is activated, process- 
ing of the sequencer is only continued in the event of a supervision error when an 
acknowledgment has been made. 


If the Permanent processing of all interlocks in manual mode attribute is activated, 
the interlock conditions of all steps, including the non-activated ones, are pro- 
cessed in manual mode. 


The activated Lock operating mode selection attribute prevents a manual change- 
over of the operating mode via the Testing task card. 


11.3.7 Using the GRAPH function block 


You define the number of block parameters prior to calling. You make the default 
setting in the main menu using the Options > Settings command under PLC pro- 
gramming > GRAPH in the Interface section. If the Maximum interface parameters 
option is activated, the maximum parameter set is shown, otherwise the standard 
parameter set. The standard parameter set allows operation of the sequential con- 
trol in the various operating modes with the possibility for acknowledging messag- 
es. The maximum parameter set contains additional parameters for diagnostics. 
You can manually add or remove individual parameters in both parameter sets. Ex- 
ception: GRAPH-specific parameters which are not available in the minimized data 
block cannot be added manually. 


For the currently opened block, you define the parameter set using the Edit > 
Maximum interface parameters or Edit > Default interface parameters command. 


Calling the GRAPH function block 


The function block for the sequential control is always called as a single instance. 
Open the called block, drag the GRAPH function block from the project tree into the 
working area, and define the instance data block. 


When generating the instance data block, the GRAPH editor creates the PLC data 
types GraphStep or GraphStepMin and GraphTransition or GraphTransitionMin de- 
pending on the Create minimized DB attribute. GraphStep and GraphTransition con- 
tain the GRAPH-specific tags for each step or transition (see Chapter 11.2.4 
“GRAPH-specific tags” on page 437). You can address these tags in the GRAPH func- 
tion block using #Step_name.var or #Transition_name.var, or outside the function 
block using “DB_name”.Step_name.var or “DB_name’”.Transition_name.var. 


Example: If a step is named Drives_on, you can scan the step activation using 
#Drives_on.S1 and the fault-free step activation time using #Drives_on.U in the 
GRAPH function block. 
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Operating modes 


The operating modes of the sequential control are controlled using positive signal 
edges at the input parameters: 


> SW_AUTO Switch on Automatic mode 
The sequential control automatically switches to the next step if the transition is 
fulfilled. 


> SW_TAP Switch on Semiautomatic mode (“jogging”) 
The sequential control switches to the next step if the transition is fulfilled and 
if a positive edge occurs at the T PUSH parameter. 


> SW_TOP Switch on Automatic mode or Semiautomatic mode (“stepping”) 
The sequential control switches to the next step if the transition is fulfilled or if 
a positive edge occurs at the T_PUSH parameter. 


> SW_MAN _ Switch on Manual mode 
The sequential control activates the step displayed at the S_ NO output parameter 
if a positive edge occurs at the S ON parameter. The step displayed at the S NO 
parameter is deactivated by a positive edge at the S OFF parameter. You can de- 
fine a special step using the S_SEL parameter. You can switch to the previous step 
(in the direction of smaller step numbers) using the S PREV parameter and to 
the subsequent step using S_NEXT. 


The parameters described are available with both the maximized and standard pa- 
rameter sets. 


Compiling the GRAPH function block 


You compile a GRAPH function block just like any other function block (see Chapter 
6.5 “Compiling blocks” on page 273). 


For optimum use, the GRAPH function block requires an additional system block. 
The system function SFC 73 G7_STD_4 is used if the Create minimized DB attribute 
is activated, or the system function SFC 72 G7_STD_3 with the standard memory 
space model. When compiling, the system block is stored in the project tree under 
Program blocks > System blocks > Program resources. 


11.4 Testing the sequential control 


A prerequisite for testing the user program is an online connection between the 
programming device and the machine or plant to be controlled. The user program 
has been compiled without errors and downloaded to the CPU. The general proce- 
dure is described in Chapter 15.5 “Testing the user program” on page 613. 


Additional information must be observed when loading the GRAPH function block. 
To enable testing of a GRAPH sequential control, you can use the following test func- 
tions: program status for sequencers and individual steps, control sequencer, and 
synchronize sequencer. 
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11.4.1 Loading the GRAPH function block 


If you change the program in the GRAPH function block, you must create the 
instance data block again so that the changes - for example new steps and transi- 
tions - are imported into the data block. 


Reloading of a (modified) GRAPH function block with the associated instance data 
block in RUN mode can lead to problems in execution of the sequential control. 
Therefore you must deactivate the sequential control prior to reloading. You can al- 
ways do this in the general settings or when loading. 


Standard deactivation of the sequential control when loading can be set in the main 
menu using the Options > Settings command under PLC programming > GRAPH in 
the Load section: Activate the Turn off sequence before downloading DB option. If the 
option is deactivated, you can set the Turn off sequence before downloading DB ac- 
tion when downloading the GRAPH function block with the instance data block in 
the Download preview window. 


11.4.2 Settings for program testing 


The settings for program testing are made in the task window on the Testing task 
card (see Fig. 11.9 on the right). Open the GRAPH function block online and click on 
the Test settings pallet in the Testing task card. The attributes referred to below are 
described in Chapter 11.3.6 “Attributes of the GRAPH function block” on page 453. 
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Fig. 11.9 Test aids for GRAPH in the Testing task card 
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When activated, the settings have the following meaning: 


> 


Track active step 
The respective current step is displayed in the single step view or sequence view. 


Skip steps 
A step whose preceding and following transitions are active is skipped, i.e. not 
activated (only available with non-activated attribute Generate minimized DB). 


Acknowledge supervision alarms 
Only available if the Acknowledge supervision alarms attribute is activated. This 
setting is then switched on by default. 


Stop sequence 
If the following transition is fulfilled, processing of the sequencer is stopped. 


Stop timers 
All step activation timers are stopped. If the setting is canceled, the step activa- 
tion timers continue to run. 


Process all interlocks 

Only available if the Permanent processing of all interlocks in manual mode 
attribute is activated and Manual mode is switched on. When using the setting, 
the sequencer must be synchronized. 


Process all transitions 
All transitions are processed. It is indicated whether the respective transition is 
fulfilled. 


Activate actions 
This setting is switched on by default. If it is switched off, no further actions are 
executed in the active step. 


Activate supervisions 
This setting is switched on by default. If it is switched off, the supervision is 
ignored in the active step. 


Activate interlocks 
This setting is switched on by default. If it is switched off, the interlock condition 
is ignored in the active step. 


Which test settings are selectable depends on the operating mode of the sequential 
controller. 


11.4.3 Using operating modes 


When testing, you can set the operating modes of the sequential control in the 
Sequence control pallet on the Testing task card (Fig. 11.9 on the left). 


Select the operating mode prior to actual program testing: 


> 


> 


Automatic mode 
The next step is activated as soon as the transition is fulfilled. 


Semiautomatic mode 
The next step is activated as soon as 
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¢ the valid transition is fulfilled or 
* arising edge occurs at the block parameter T_PUSH or 
¢ the Ignore transition button is clicked. 


> Manual mode 
The step to be activated is selected manually. 


You commence testing of the sequential control by clicking on the Initialize button. 
You can deactivate all steps using the Deactivate all button. The Acknowledge -(V)- 
button is used to acknowledge a supervision error. 


In manual mode you switch to the next step by clicking on the Next button when the 
transition is fulfilled. 


In manual mode you can activate any step by entering its number in the Step 
number box and clicking on the Enable button. Proceed accordingly to deactivate a 
step. As an alternative to entering the step number, you can also select the step to 
be activated or deactivated in the sequencer which is displayed in the GRAPH navi- 
gation or in the working window. 


11.4.4 Synchronization a sequencer 


A sequential control only works correctly if the statuses of the sequencer and the 
process to be controlled are matched to each other. If individual steps are activated 
and deactivated when testing in manual mode, it is possible that the sequential 
control and the controlled process are no longer synchronous. You should synchro- 
nize the sequencer before leaving manual mode and switching to automatic or 
semiautomatic mode. 


To synchronize the sequencer, activate the Enable synchronization checkbox in the 
Sequence control pallet on the Testing task card. There are two manners in which the 
synchronization point - the step to be activated - can be found: 


> Ifyou select the Preceding transition satisfied option, all steps are selected whose 
previous transition is fulfilled and whose following transition is not fulfilled. 


> If you select the Interlock condition satisfied option, all steps are selected whose 
interlock condition is fulfilled and whose following transition is not fulfilled. 


To carry out synchronization, select the desired step in the GRAPH navigation or in 
the sequencer view in the working window and click on the Enable button. 


11.4.5 Testing with program status 


The general procedure for testing with program status is described in 
Chapter 15.5.3 “Testing with program status” on page 614. 


For testing with program status, open the GRAPH function block and switch the pro- 
gram status on using the Monitoring on/off symbol in the toolbar of the working 
window. If an online connection to the CPU does not yet exist, the connection dialog 
is opened. The dialog for activation of test mode is opened following establishment 
of the online connection. You must switch on test mode in order to simultaneously 
monitor several networks in the single step view. Note that the cycle processing 
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time is extended in test mode (see also Chapter 15.5.1 “Process and test modes” on 
page 613). 


Program status in the sequencer view 


You switch on the sequencer view using the Sequencer view symbol in the toolbar of 
the working window. The program status in the sequencer view indicates the status 
of a step or transition using different colors: 


> Step shown in green: No fault present. 

> Step shown in red: A supervision error is present. 

> Step shown in yellow: An interlock error is present. 

> Transition shown in green: The transition is fulfilled. 


> Transition shown in black: The transition is not fulfilled. 


You can use the Acknowledge button on the Sequence control pallet in the Testing 
task card to switch to the next step despite the presence of an error. 


Program status in the single step view 


In the GRAPH navigation, select the step to be monitored and switch on monitoring. 
The action list is extended by the monitored value (Fig. 11.10). Depending on the 
representation in LAD or FBD, the logic operations are displayed with a green con- 
tinuous line (for signal state “1”) or a blue dashed line (for signal state “O”) in the 
conditions for interlock, supervision, and transition. 


No trigger applied. 


arFl/ar ft + qe OMP2T OMP>U CONV NEG SWAP 


$2: Drives_on 
Switch-on of milling drive, clamping jig, and fan 


> Interlock -(c)-: Pes 
> Supervision -(v)-: == 
S< Actions: —- 


Step activation time (1): T#OMS 


ach Interlock Event Qualifier Action 
40- SI S  -Settol "Milling drive" "Milling drive” (Sa 
$1 S  -Setto1 "Tension_valve" "Tension_valve” re: j 
$1 s -Setto1 "Blower_motor™ “Blower_motor™ 
<Add new> 


v T2-Switchedon: = _. 
“Speed reached" “Workpart tensed” “Blower works” 


KH | ---------- 4 penn nnn nn nnn nnn nnn nnn fee ett tteneteene Switched on 


Shafting 


Fig. 11.10 Example of the program status in the single step view in LAD 
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To select the display format, click in the action list on a monitored value and select 
the Display format for network > ... or Display format > ... command from the short- 
cut menu. You can then select between automatic, decimal, hexadecimal, and float- 
ing-point. 


To control a tag in the action list or in one of the conditions, click on the tag and se- 
lect the Modify >... command from the shortcut menu. You can then select between 
Modify to 0, Modify to 1, and Modify operand in order to define a digital value. 


In order to reduce the cycle processing time when testing, you can switch on the 
program status in a condition starting at a particular point in the program or only 
monitor a specific tag. Click on the tag starting at which the program status is to be 
displayed or which is to be monitored and select the Modify > Monitor from here or 
Modify > Monitor selection command from the shortcut menu. 
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12 Basic functions 


This chapter describes the basic functions largely independent of the program lan- 
guage selected. Binary logic operations are an exception, for the differences 
between the programming languages are greatest with these functions. 


The Chapters 7 “Ladder logic LAD” on page 283, 8 “Function block diagram FBD” on 
page 315, 9 “Statement list STL’ on page 348, and 10 “Structured Control Language 
SCL” on page 397 describe how you can program the functions using the individual 
programming languages and what special features exist. 


12.1 Binary logic operations 


12.1.1 Introduction 


Binary logic operations process the signal statuses of binary tags in accordance 
with AND, OR, and exclusive OR. The implementation of binary logic operations 
varies significantly in the various programming languages: 


Ladder logic (LAD) uses NO and NC symbols in series and parallel connections, 
with a coil as termination. 


In the function block diagram (FBD), function boxes handle the linking of binary 
signals. 


In the statement list (STL), the binary logic operations are scans positioned un- 
derneath each other. 


With the Structured Control Language (SCL), expressions with binary tags form 
the binary logic operations. 


Binary logic operations can be used together with all binary tags. The result of a 
binary logic operation can be processed further as follows: 


> Control of a binary tag with a binary memory function, e.g. with a simple coil 
(LAD) or an assignment (FBD, STL, SCL). 


> Control of program execution using a conditional jump or a conditional block 
call (EN input). 


> Supply of a binary function input or a binary block parameter. 


Binary logic operations can be combined together so that, for example, the output 
of one logic operation can lead to the input of the next one, or series connections 
can be connected in parallel. Possible combinations are described for LAD in 
Chapter 7.2.2 “Series and parallel connection of contacts” on page 287, for FBD in 
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Chapter 8.2.6 “Combined binary logic operations, negating result of logic opera- 
tion” on page 321, for STL in Chapter 9.2.7 “Combined binary logic operations” on 
page 355, and for SCL in Chapter 10.2.5 “Combined binary logic operations” on 
page 403. 


12.1.2. Working with binary signals 


Signal states “1” and“0” 


The term “signal state” refers to a logic status in a binary logic operation, without 
considering the physical implementation. Two (contrary) statuses are simply iden- 
tified as signal state “1” and signal state “O”. It could be understood, for example, 
that signal state “1” can always be equated to a higher electrical potential than sig- 
nal state “0”, but this is incorrect. The same applies to the graphic metaphor in the 
ladder logic, i.e. a “current” flows with signal state “1” and does not with signal state 
“0”. 


Signal state “1” and signal state “O” are two terms which allow description of the 
logic operations in a user program. It is insignificant how these statuses are imple- 
mented physically within the CPU. These terms have a physical correlation at the in- 
terface to the controlled machine or process. The type of digital module defines how 
the logic term “Signal state” is converted into a physical variable and vice versa, and 
how a physical variable is converted into a signal state “1” or “0”. 


The terms “TRUE” and “FALSE” are also commonly used for signal states “1” and “0”. 
As a side note: In this book, the signal states “1” and “0” are set in quotation marks 
to distinguish them from the digits 1 and 0. 


Types of digital modules 


The type of digital input module determines how a physical variable is converted 
into a signal state (Fig. 12.1): 


> Ifthe module is designed for connection of an AC voltage transmitter, “Voltage 
present” at the module terminal means signal state “1” and “No voltage present” 
or an open connection means signal state “0”. 


> If a module has the property “Sinking input”, a positive (DC) voltage at the 
module terminal is converted into signal state “1”. Zero voltage (ground) or an 
open connection means signal state “0”. 


> If a module has the property “Sourcing input”, zero voltage (ground) at the 
module terminal means signal state “1” and a positive voltage or an open con- 
nection means signal state “0”. 


The type of digital output module determines how a signal state is converted into a 
physical variable in an assignment to an output: 


> If the module is designed for connection of an AC voltage load, signal state “1” 
means that voltage is present at the module terminal. The terminal is deener- 
gized if the signal state is “0”. 
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Connection to a programmable controller 


L+ 


@ Sinking input modules deliver signal 
] ] state "1" if a positive voltage is present 
at the input terminal. 


@ With signal state "1", Sourcing output 
modules switch on a load which is 
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Fig. 12.1 Connection of binary signals to a programmable controller 


> Ifthe module possesses output relays, the relay contact is closed with signal state 
“1” and open with signal state “0”. 


> Amodule with the property “Sourcing output” delivers a positive (DC) voltage in 
the case of signal state “1” at the module terminal and no voltage in the case of 
signal state “O” (high-impedance to power supply with electronic output ampli- 
fiers). 


> Ifa module has the property “Sinking output”, it delivers zero volt (ground) at 
the terminal in the case of signal state “1” and no voltage in the case of signal 
state “O” (high-impedance to ground with electronic output amplifiers). 


Types of sensors, NO contacts, and NC contacts 


The CPU obtains control signals and feedbacks from the machine or process via 
sensors (signal transmitters, limit switches, pushbuttons, etc.). There are two types 
of binary sensors: normally open contacts and normally closed contacts. Anormally 
open (NO) contact is a sensor which closes a circuit when activated. A normally 
closed (NC) contact interrupts a circuit when activated. It is used, for example, in 
closed circuit connections in order to switch off a control function when activated 
or to control the machine to a safe state in the case of an open-circuit. 


To allow better understanding of the control function, it is usually defined in the user 
program that an action is triggered by signal state “1”. In addition, certain control 
functions only result in actions with signal state “1”. Therefore it may be necessary to 
convert an zero-active signal to signal state “1” (i.e. negate it) before it is used in the 
user program. LAD has the NC contact for this purpose, FBD and STL have the scan for 
signal state “O”, and SCL has the negation NOT (Fig. 12.2). 
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Scan signal state of binary tags 


The signal state of a binary tag, for example an input, has to be scanned before it can be gated with other 
signal states. In association with a scan, the signal state can be negated if this is necessary for the logic 
operation. Different symbols are used in the various programming languages for scanning of the signal 
state. 


Direct scan Negated scan Ladder logic LAD 
LAD uses an NO symbol for the direct scan 
Tag Tag (scan for signal state "1") and an NC symbol for 


—| |___. | —_. the negated scan (scan for signal state"0"). 


Function block diagram FBD 

In FBD, the scan for signal state"1" is represented 
as a direct input of a function box, and the 
negated scan (scan for signal state "0") by the 
negation symbol (the negation circle) on the 
function box. 


Tag —— Tag —O 


Statement list STL 


STL uses the binary functions A, O and X to scan 
A tag AN tag for signal state "1". With the negated scan 
fo) tag ON tag (scan for signal state "0"), an "N" is appended to 
xX tag XN tag the binary function (AN, ON, XN). 


Structured Control Language SCL 


In association with a logical operator AND, OR 
AND tag AND NOT tag and XOR, a direct scan is always present with SCL 
OR tag OR NOT tag (scan for signal state "1"). The negated scan 
XOR tag XOR NOT tag (scanfor signal state "0") is emulated by the 
NOT function. 


Fig. 12.2 Direct and negated scanning of a binary operand 


Result of logic operation, assignment 


The user program contains the statements for the control processor on how the sig- 
nal states are to be linked together. The signal state resulting from the linked signal 
states is referred to as Result of logic operation. The result of logic operation as- 
sumes the value “O” or “1” just like a signal state. The result of logic operation can 
be linked to further binary functions. 


The result of logic operation is output in order to control an actuator (relay, contac- 
tor, lamp, etc.). The memory functions, primarily the assignment, are available for 
this purpose. An assignment takes over the original signal state of the result of logic 
operation. If it is necessary to output the negated signal state (the opposite result 
of logic operation), a negation is programmed prior to the assignment. 


12.1.3 AND function, series connection 


The AND function links two or more binary states together and delivers a result of 
logic operation “1” if all states (all results of the scans) are simultaneously “1”. In 
all other cases, the result of logic operation is “0” (Fig. 12.3). 
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AND function, series connection 


LAD 
Series connection of contacts 


Binary tag 1 Binary tag 2 Binary tag 3 
FBD ; 
AND box & Binary tag 3 
Binary tag 1 — = 
Binary tag 2 — — — 
STL ; eh 
AND function Bi oBinary. Cag. 
A Binary tag 2 


Binary tag 3 


SCL 


: Binary tag 3: 
AND function e ae 


Binary tag 3: 


Binary tag 1 & Binary tag 2; 
Binary tag 1 AND Binary tag 2; 


7 The AND function is fulfilled if all function inputs 
Tags Signal state have the signal state "1". The AND function then 
’ : delivers a result of logic operation "1" at its function 
Binary tag 1 “o" "to" 4 output, shown in the examples by the assignment 
Binary tag 2 "0" "o" "1 "1° (coil). 
Binary tag 3 "oO" "0" "oO" ie beg 


Each AND function in the examples is shown with two inputs; the number of inputs of an AND function 
is theoretically unlimited. 


Note: In the examples, the binary tags are scanned directly (for signal state "1"). With a negated scan 
(for signal state "0") it is necessary to consider the negated signal state of the binary operands for the 
AND operation. 


Fig. 12.3 Representation and principle of operation of the AND function 


LAD implements the AND function using a series connection of contacts. FBD uses 
the AND box with two or more inputs. In STL, the AND function is represented by 
the AND (A) operation. SCL uses the logic operator AND or &. 


12.1.4 OR function, parallel connection 


The OR function links two or more binary states together and delivers a result of 
logic operation “0” if all states (all results of the scans) are simultaneously “0”. In 
all other cases, the result of logic operation is “1” (Fig. 12.4). 


LAD implements the OR function using a parallel connection of contacts. FBD uses 
the OR box with two or more inputs. In STL, the OR function is represented by the 
OR (O) operation. SCL uses the logic operator OR. 


12.1.5 Exclusive OR function, non-equivalence function 


The exclusive OR function links two or more binary states together and delivers a 
result of logic operation “1” if an odd number of states (of the scan results) are si- 
multaneously “1”. In all other cases, the result of logic operation is “0”. In the spe- 
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OR function, parallel connection 


LAD 
Parallel connection of contacts 


Binary tag 1 Binary tag 3 
Binary tag 2 
FBD 
OR box il Binary tag 3 
Binary tag 1 —— = 
Binary tag 2 — — — 
oe O Binary tag 1 
OR function Oe Winery nage 


Binary tag 3 


SCL 


: Binary tag 3 := Binary tag 1 OR Binary tag 2; 
OR function Wace, aac) HOSE 


la Si Istat The OR function is fulfilled if at least one of the 
gs Ign ahsrate. function inputs has the signal state "1". 

; The OR function then delivers a result of logic 
Binary tag 1 "0" os es operation "1" at its function output, shown in the 
Binary tag 2 no" "OQ" "" "" examples by the assignment (coil). 

Binary tag 3 "0" "y" "y" "1" 


Each OR function in the examples is shown with two inputs; the number of inputs of an OR function is 
theoretically unlimited. 


Note: In the examples, the binary tags are scanned directly (for signal state '"1"). With a negated scan 
(for signal state "0") it is necessary to consider the negated signal state of the binary operands for the 
OR operation. 


Fig. 12.4 Representation and principle of operation of the OR function 


cial case where the exclusive OR function has two inputs, it delivers the result of log- 
ic operation “1” if the two inputs have different signal states (Fig. 12.5). 


The exclusive OR function does not exist with LAD. The function can be emulated us- 
ing series and parallel connections. FBD uses the exclusive OR box with two or more 
inputs. In STL, the exclusive OR function is represented by the exclusive OR (X) oper- 
ation. SCL uses the logic operator XOR. 


12.1.6 Negate result of logic operation, NOT contact 


The result of logic operation can be negated at any position within a logic opera- 
tion. Signal state “1” then becomes “0” and vice versa (Fig. 12.6). 


Ladder logic 


The NOT contact negates the “current flow”. If the current path has “current” prior to 
the NOT contact, no more “current” flows following the NOT contact and vice versa. 
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Exclusive OR function, non-equivalence function 


LAD 
The exclusive OR function must be emulated by a combination of series and parallel 
connections. 
FBD 
Exclusive OR box x Binary tag 3 
Binary tag 1 — = 
Binary tag 2 — — — 
ms xX Bi 1 
Exclusive OR function ant Ys Gag 
X Binary tag 2 
= Binary tag 3 
SCL : Binary tag 3 := Binary tag 1 XOR Binary tag 2; 
XOR function 
Ta Signal stat The exclusive OR function is fulfilled if an odd 
gs AGNAL Save number of the function inputs has the signal 
; re wT ee te state "1". The exclusive OR function then delivers a 
Binary tag 1 0 1 0 1 result of logic operation "1" at its function output, 
Binary tag 2 "0" ROM CMa: Ne shown in the examples by the assignment. 
Binary tag 3 "i" myn omgm age 


Each exclusive OR function in the examples is shown with two inputs; the number of inputs of an 
exclusive OR function is theoretically unlimited. 


Note: In the examples, the binary tags are scanned directly (for signal state '"1"). With a negated scan 


(for signal state "0") it is necessary to consider the negated signal state of the binary operands for the 
exclusive OR operation. 


Fig. 12.5 Representation and principle of operation of the exclusive OR function 


Negation of result of logic operation 


LAD 
NOT-contact (RLO1) — NOT}——— (RLO2) 

FBD 

Negation symbol 

(RLO1) —O (RLO2) (RLO1) Q— (RLO2) 
STL (RLO1) 
NOT statement NOT 
(RLO2) 
SCL 
NOT operator (RLO1) NOT (RLO2) 
. The negation reverses the result of the logic operation: 

Tags Signal state Signal state "1" become signal state "0", and "0" becomes "1". 

RLO1 "Q" “e 

RLO2 me "ig" 


Fig. 12.6 Representation and principle of operation of the negation 
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Function block diagram 


The negation circle at the input or output of a function symbol negates the result of 
logic operation. You can 


> apply the negation to the scan of a binary operand; this then corresponds to 
scanning for signal state “0”, 


> set the negation between two binary functions (this corresponds to negation of 
the result of logic operation), or 


> position the negation at the output of a binary function (e.g. if you wish to set or 
reset a binary operand and the logic operation is not fulfilled, i.e. RLO = “0”). 


Statement list 


The NOT operation negates the result of logic operation. You can use NOT at any 
position, also within a logic operation. You can use this operation, for example, to 
apply a negated AND function to an output. 


Structured control language 


The NOT operator negates the result of logic operation. You can use NOT at any po- 
sition within an expression. If NOT is positioned directly before a tag, the signal 
state of the tag is negated (corresponds to scanning for signal state “O”). NOT posi- 
tioned before an expression negates the result of logic operation of the expression. 


12.2 Memory functions 


12.2.1 Introduction 


The memory functions are used together with the binary logic operations in order 
to influence the signal states of binary tags using the result of logic operation gen- 
erated by the control processor. 


The following memory functions are available: 
> Assignment of the result of logic operation 
> Single setting and resetting 

> Dominant setting and resetting 

> Edge evaluations 


The memory functions can be used together with all binary tags. There are limita- 
tions when using temporary local data bits as edge trigger flags. 


A result of logic operation can be used to influence several memory functions si- 
multaneously. The result of logic operation does not change during execution of a 
memory function. 
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12.2.2 Standard coil, assignment 


The assignment is used to transfer the result of logic operation to a binary tag. If 
the result of logic operation is “1”, the binary tag is set to signal state “1”; if itis “O”, 
the binary tag is set to signal state “O” (Fig. 12.7). 


Standard coil, assignment 


LAD 
Standard coil Binary tag 

RLO —_+( }+——— (RLO) 
FBD 
Assign-box Binary tag 

RLO — — (RLO) 
STL tid // (RLO) 
Assignment = Binary tag 
SCL 
Assignment Binary tag:= (... RLO ...); 

: The standard coil or the assignment transfers the 
BLO tags elgnal state result of the logic operation to the binary tag. 
Result of logic operation ng" "" The result of the logic operation is not changed by 
the assignment. 
Binary tag "0" os 


Fig. 12.7 Representation and principle of operation of the assignment 


With LAD, the assignment is represented by the standard coil, with FBD by the as- 
sign box. With STL, the “=” operation stands for the assignment and with SCL the 
assignment operator “:=”. 


With the MCR dependency switched on, the binary operand present with the stan- 
dard coil or assignment is set to signal state “0”. 


12.2.3 Single setting and resetting 


Single setting sets a binary tag to signal state “1” if the result of logic operation is 
“1”. The binary tag is not influenced if the result of logic operation is “0”; it remains 
set if it was set, and remains reset if it was reset. 


Single resetting sets a binary tag to signal state “0” if the result of logic operation 
is “1”. The binary tag is not influenced if the result of logic operation is “0”; it re- 
mains set if it was set, and remains reset if it was reset (Fig. 12.8). Single setting 
and resetting do not influence the result of logic operation. 


With the MCR dependency switched on, the binary operand present with the single 
set or reset is no longer influenced (the signal state is “frozen”). 
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Single setting and resetting 


LAD 
S-coil, R-coil Binary tag 1 Binary tag 2 

RLO ———{ s }——R10) RLO ———{ rR }}—— (R10) 
FBD 
S-box, R-box Binary tag 1 Binary tag 2 

5) R 

RLO — RLO — 
STL 
Set-operation, er // (RLO) a // (RLO) 
reset-operation S Binary tag 1 R Binary tag 2 
SCL 
Emulation with IF (RLO) THEN IF (RLO) THEN 
the IF-statement Binary tag 1 := TRUE; Binary tag 2 := FALSE; 

END_IF; END IF; 

. If the result of the logic operation is "1", the tag for 
RLO, tags Signal state the set statement is set to signal state "1", and the 
: : a ate tag for the reset statement is reset to signal state "0". 
Result of logic operation 0 a A result of logic operation "0" has no effect. 
Binary tag 1 (S) | Unchanged nye Renscinoe a logic operation is not changed by 
Binary tag 2 (R) | Unchanged "0" 


Fig. 12.8 Representation and principle of operation of the set and reset functions 


With LAD, single setting is represented by the set coil, and single resetting by the 
reset coil. With FBD, single setting is represented by the set box, and single reset- 
ting by the reset box. With STL, an “S” stands for setting a binary operand, and an 
“R” for resetting. SCL only has the assignment operator for controlling a binary op- 
erand. Setting or resetting a binary operand with RLO = “1” can be emulated to- 
gether with other SCL statements, for example by the IF statement. 


To make the programming clearer, you should always use the single set and reset 
statements in pairs for a specific binary tag, and only once each. You should also 
avoid controlling this binary tag in addition by an assignment. 


When using the individual memory functions on the same binary tag, the position- 
ing sequence is important since with simultaneous activation of the set and reset 
statements, the statement processed last is dominant. For example, if the reset 
statement is processed following the set statement, resetting is dominant. 


Note that the binary tag used for a single memory function may be reset during 
startup by the CPU's operating system. In certain cases, the signal state is retained: 
This depends on the operand area used (e.g. static local data) and on the settings 
in the CPU (e.g. retentive behavior). 
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12.2.4 Dominant setting and resetting, memory function 


The functions of single setting and resetting are combined in a memory box. The 
common binary tag is named above the box. The S or S1 input corresponds to single 
setting, the R or R1 input to single resetting. The signal state possessed by the bi- 
nary tag named above the memory function is present at the Q output of the mem- 
ory function. 


There are two versions of the memory function: as SR box (reset dominant) and as 
RS box (set dominant). In addition to the difference in the label, the two boxes also 
differ in the positioning of the set and reset inputs (Fig. 12.9). 


A memory function is set (or more precisely: the binary tag named above the mem- 
ory box) when the set input has signal state “1” and the reset input has signal state 
“0”. Amemory function is reset when “1” is present at the reset input and “0” at the 


Dominant setting and resetting 


Emulation by the sequence 
of set and reset statements 


S Binary tag 1 


3 // (RLO2) 
R Binary tag 1 


ae Binary tag 1 Binary tag 2 
SR-box, RS-box = = 

RLO1 —S RLO2 ——R 

RLO2 ——RI1 oi RLO1 —S1 Q— 
FBD . . 
SR-box, RS-box Binary tag 1 Binary tag 2 

SR RS 

RLO1 —S RLO2 —-R 

RLO2 ——R1 Q— RLO1 —S1 Qq— 
STL 

//(RLO1) // (RLO2) 


R Binary tag 2 


a // (RLO1) 
S Binary tag 2 


SCL 
Emulation with the 
IF statement 


IF (RLO2) 


THEN Binary tag 1:= FALSE; 


ELSIF (RLO1) 
THEN Binary tag 1 
END_IF; 


//Reset dominant 


:= TRUE; 


IF (RLO1) 
THEN Binary tag 2:= TRUE; //Set dominant 
ELSIF (RLO2) 
THEN Binary tag 2 := FALSE; 
END_IF; 
¢ Result of logic operation "1" at the set 
Danae pigualerte input sets the binary tag, result of logic 
RLO 1 (set) spi ies ag “40 operation "1" at the reset input resets it. 
RLO 2 (reset) "o" "ge myn yz" If both inputs are "1" simultaneously, the 
binary tag at the SR-box is reset and the 
Binary tag 1 (SR box) J “qe “o" "on binary tag at the RS- box is set. 
Binary tag 2 (RS box) - "7" gn "" 


Fig. 12.9 Dominant setting and resetting, memory boxes 
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set input. Signal state “O” at both inputs has no influence on memory functions. If 
signal state “1” is present simultaneously at both inputs, the two memory functions 
respond differently: the SR memory function is reset, the RS memory function is set. 


With the MCR dependency switched on, the binary operand at the RS box or SR box 
is no longer influenced (the signal state is “frozen”). 


With STL, the memory function is implemented by single setting and resetting. The 
sequence of statements defines whether setting or resetting is dominant. With SCL, 
the memory function can be emulated, for example, by an assignment together 
with an IF statement. 


Note that the binary tag used for a memory function may be reset during startup by 
the CPU's operating system. In certain cases, the signal state of amemory box is re- 
tained: This depends on the operand area used (e.g. static local data) and on the set- 
tings in the CPU (e.g. retentive behavior). 


12.2.5 Edge evaluation 


Principle of operation of an edge evaluation 


Edge evaluation detects the change in a signal state, a signal edge. A positive (ris- 
ing) edge is present if the signal changes from state “0” to state “1”. In the reverse 
case one speaks of a negative (falling) edge. 


In the circuit diagram, the equivalent of an edge evaluation is a passing contact. If 
this passing contact outputs a pulse when the relay is switched on, this corresponds 
to the rising edge. A pulse of the passing contact when switching off corresponds to 
a falling edge. 


The detection of a signal edge - the change in a signal state — is implemented in the 
program. When processing an edge evaluation, the CPU compares the current re- 
sult of logic operation, e.g. the result of scan of an input, with a saved result of logic 
operation. If the two signal states are different, a signal edge is present (Fig. 12.10). 


The saved result of logic operation (RLO) is present in a so-called “edge trigger flag” 
(this need not necessarily be a bit memory). It must be a binary operand whose sig- 
nal state must be available again during the next processing of the edge evaluation 
(in the next program cycle) and which you do not otherwise use in the program. 
Memory bits, data bits in global data blocks, and static local data bits in function 
blocks are suitable as operands. 


This edge trigger flag saves the “old” RLO, namely the result of logic operation with 
which the CPU processed the edge evaluation last. If a signal edge is now present, 
i.e. if the current RLO is different from the signal state of the edge trigger flag, the 
CPU updates the signal state of the edge trigger flag in that it assigns the current 
RLO to it. The signal state of the edge trigger flag is equal to the current RLO (if this 
has not changed again in the meantime) during the next processing of the edge 
evaluation (usually in the next program cycle), and the CPU does not detect an edge 
any more. 
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Positive edge evaluation, evaluation with rising edge 


Description Successive processing cycles 
@ Initial state @ @ ® ® © 
@ The rising edge is detected, the edge trigger : 

flag is tracked, the pulse flag is set Edge aia 
@ No edge any longer, the pulse flag is reset 
@ No change Edge trigger 
© The edge trigger flag is tracked, the initial flag 

state is subsequently present again 

Pulse flag 


Negative edge evaluation, evaluation with falling edge 


Successive processing cycles 


Description ° e ° oO ° 
@ Initial state 
@ The edge trigger flag is tracked Edge signal 
© No change 
@ The falling edge is detected, the edge trigger = 

flag is tracked, the pulse flag is set poe trigger 
© Noedge any longer, the pulse flag is reset, ed 

the initial state is subsequently present again 

Pulse flag 


Fig. 12.10 Principle of operation of an edge evaluation in successive cycles 


A detected edge is indicated by the RLO following edge evaluation. If the CPU de- 
tects a signal edge, it sets the RLO following edge evaluation to “1”. The RLO is equal 
to “0” if a signal edge is not present. 


Signal state “1” following an edge evaluation therefore means “Edge detected”. 
Signal state “1” is only present for a brief time, usually only for one processing cy- 
cle. Since the CPU does not detect an edge during the next processing of the edge 
evaluation (if the “input RLO” of the edge evaluation does not change), it resets the 
RLO to “0” again following edge evaluation. 


You can directly process the RLO following edge evaluation, e.g. link it further to bi- 
nary logic operations, save it in a memory function, or assign it to a binary tag (a 
so-called “pulse flag”). A pulse flag is used if the RLO of the edge evaluation is also 
to be processed at another position in the program; it is quasi the intermediate 
memory for a detected edge (the passing contact in the circuit diagram). Memory 
bits, data bits in global data blocks, and temporary and static local data bits are suit- 
able as pulse flags. 


Also take note of the response of edge evaluation when switching on the CPU. If an 
edge should not be detected, the RLO prior to edge evaluation and the signal state 
of the edge trigger flag must be the same when switching on. It may be necessary — 
depending on the desired response and the operand area used — to appropriately 
set or reset the edge trigger flag during the startup. 


Principle of operation of positive edge: @ In the initial state, the signal being mon- 
itored for an edge, the edge trigger flag, and the pulse flag have signal state “O”. 
@ The edge signal then changes its state from “0” to “1”. The signal state of the edge 
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trigger flag is initially still “O” so that a rising edge is detected and the pulse flag is 
set to “1”. The edge trigger flag is updated to signal state “1”. @ The next processing 
cycle does not show a change in the signal state or edge signal (comparison with 
signal state of edge trigger flag). The pulse flag is reset to “O”. @ No changes take 
place in the next processing cycles. © If the edge signal is reset to state “O” again, 
the edge trigger flag is also updated and the initial state is reached. The pulse flag 
was therefore only set to “1” for one processing cycle. 


Principle of operation of negative edge: @ In the initial state, the edge signal, the 
edge trigger flag, and the pulse flag have signal state “0”. @ The edge signal then 
changes its state from “0” to “1”. This change is saved in the edge trigger flag, which 
is also set to “1”. The pulse flag remains “O” since a falling edge is not present. 
© No changes take place in the next processing cycles. @ The edge signal then 
changes from “1” to “0”. The edge trigger flag still has signal state “1” initially and 
a falling edge is therefore detected. The pulse flag is set to “1” and the edge trigger 
flag updated to “0”. @ The pulse flag is reset to “O” again. The pulse flag was there- 
fore only set to “1” for one processing cycle. 


Edge evaluation of result of logic operation 


This edge evaluation generates a pulse when the result of logic operation changes 
(with ladder logic: change in “current flow”). The P_TRIG box is available for evalu- 
ation of a positive edge and the N_TRIG box for evaluation of a negative edge. 


The positive edge evaluation generates the pulse with a change in signal state from 
“0” to “1” (rising edge) at the CLK input and the negative edge evaluation with a 
change in signal state from “1” to “0” (falling edge). The pulse is available at the Q 
output of the edge evaluation. 


Fig. 12.11 shows the representation and signal states of edge evaluation. The prin- 
ciple of operation of edge evaluation is described in detail in Fig. 12.10: The edge 
signal corresponds to the result of logic operation present at the CLK input, the 
edge trigger flag corresponds to the binary tag named underneath the function, 
and the pulse flag corresponds to the result of logic operation following the edge 
evaluation. 


Edge evaluation of a binary tag 


The edge evaluation of a binary tag is represented in the ladder logic as a contact, 
above which the scanned binary tag and below which the edge trigger flag are 
named. The pulse of the edge evaluation (quasi the signal state of the pulse flag) is 
connected in series with the result of logic operation of the preceding logic opera- 
tion. A positive, rising edge is detected by the P contact and a negative, falling edge 
by the N contact. 


In the function block diagram, the binary tag is named above the edge evaluation 
box and the edge trigger flag underneath. The Q output corresponds to the pulse 
flag. A positive, rising edge is detected by the P box and a negative, falling edge by 
the N box. Fig. 12.12 shows the representation and signal states of edge evaluation. 
The principle of operation of edge evaluation is described in detail in Fig. 12.10. 
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Edge evaluation of result of logic operation 


The P_TRIG box detects a positive edge at the 
CLK input and then sets the Q output to the signal eae woe 
state "1" for the duration of one cycle (in processing PosiGyenising) edge 
cycle @ in the table). Processing cycles} © @ © @ © 
The FP statement detects a positive edge of the 
result of the logic operation prior to the statement RLO1| "Oo" "1" "1" "QO" "QO" 
and then sets the result of the logic operation 
following the statement to the signal state "1" for Edge trigger flag1} "O" "1" "1" "Oo" "0" 
the duration of one cycle (in processing cycle @ in 
the table). RLO2/} "Oo" "7" "9" "OQ" -"Q" 
The N_TRIG box detects a negative edge at the 
CLK input and then sets the Q output to the signal z 7 
state "1" for the duration of one cycle (in processing Negative (falling) edge 
cycle @ inthetable). ; Processing cycles} © © © O © 
The FN statement detects a negative edge of the 
result of the logic operation prior to the statement RLO3/} "oO" "1" "Oo" "QO" "oO" 
and then sets the result of the logic operation 
following the statement to the signal state "1" for Edge trigger flag2| "0" "1" "0" "0" "0" 
the duration of one cycle (in processing cycle © in 
the table). RLO4 "Q" "oO" mq" "90" "OQ" 
LAD 
P_TRIG box, P_TRIG N_TRIG 
N_TRIG box RLO] —CLK Q— RLO2 RLO3 ——CLK Q — RLO4 
Edge trigger flag 1 Edge trigger flag 2 
FBD 
P_TRIG box, P_TRIG N_TRIG 
N_TRIG box RLO1 —CLK Q— RLO2 RLO3 —CLK Q— RLO4 
Edge trigger flag 1 Edge trigger flag 2 
STL 
FP statement ae (//RLO1 ahs (//RL03 
EN statement FP Edge trigger flag 1 FN Edge trigger flag 2 
//RLO2 //RLO4 
SCL ; ; IF (RLO1) & Edge trigger flag 1 //positive edge 
Emulation with THEN Pulse flag 1 := FALSE; 
the IF statement ELSIF (RLO1) 
THEN Pulse flag 1 := TRUE; 
Edge trigger flag 1 := TRUE; 
ELSE Pulse flag 1 := FALSE; 
Edge trigger flag 1 := FALSE; 
END_IF; 
IF NOT (RLO3) & Edge trigger flag 2 //negative edge 
THEN Pulse flag 2 := TRUE; 
Edge trigger flag 2 := TRUE; 
ELSIF (RLO3) 
THEN Pulse flag 2 := FALSE; 
Edge trigger flag 2 := FALSE; 
ELSE Pulse flag 2 := FALSE; 
Edge trigger flag 2 := TRUE; 
END_IF; 
In the example, the pulse flag represents the RLO at the Q output or following the edge evaluation. 


Fig. 12.11 Edge evaluation of result of logic operation (of the “current flow”) 
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Edge evaluation of a binary tag 


The P contact or the P box detects a positive edge 
of the binary tag above it and then sets the RLO to eae eae 
the signal state "1" for the duration of one cycle Hositive (ristig) edge 

(in processing cycle @ in the table). OO MOMEOMEG) 
The P contact links the RLO in front of it to the 

pulse flag according to AND (series connection). Binary tag1] "0" "1" "1" "0" "0" 


The FP statement is used in STL (see above). 


Processing cycles 


Edge trigger flag1| "Oo" "1" "1" “o" "0" 


RLO1! "0" "1" "QO" "Q" "On 


The N contact or the N box detects a negative edge 
of the binary tag above it and then sets the RLO to ‘ $ 
the signal state "1" for the duration of one cycle Negative (falling) edge 

(in processing cycle @ in the table). Processing cycles} @ © © @ O 
The N contact links the RLO in front of it to the 

pulse flag according to AND (series connection). Binary tag2] "0" "1" "O" "Oo" "0" 


The FN statement is used in STL (see above). 


Edge trigger flag 2 Ho" Mg HQT gn ng 


RLO2/ "Oo" "0" "1" "OT HE 


LAD 


P contact, Rinoty-tag.? Bipaiytag.2 
N contact —— rp} hor —— n——- ht02 
Edge trigger flag 1 Edge trigger flag 2 
FBD Binary tag 1 Binary tag 2 
P box, 
N box P N 
-— RLOT — RLO2 
Edge trigger flag 1 Edge trigger flag 2 

STU : : 

A B & f A B t 2 
FP statement pe aad Sa aie 

FP Edge trigger flag 1 FN Edge trigger flag 2 
FN statement ac //= RLOL oe //= RLO2 
SCL ; , IF Binary tag 1 & Edge trigger flag 1 //positive edge 
Emulation with the THEN Pulse flag 1 := FALSE; 
IF statement ELSIF (RLO1) 

THEN Pulse flag 1 := TRUE; 
Edge trigger flag 1 := TRUE; 
ELSE Pulse flag 1 := FALSE; 
Edge trigger flag 1 := FALSE; 
END IF; 
IF NOT Binary tag 2 & Edge trigger flag 2 //negative edge 
THEN Pulse flag 2 := TRUE; 


Edge trigger flag 2 := TRUE; 
ELSIF (RLO3) 
THEN Pulse flag 2 := FALSE; 
Edge trigger flag 2 := FALSE; 
ELSE Pulse flag 2 := FALSE; 
Edge trigger flag 2 := TRUE; 
END IF; 


In the example, the pulse flag represents the RLO at the Q output or following the edge evaluation. 


Fig. 12.12 Edge evaluation of a binary tag 
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12.3. SIMATIC timer functions 


12.3.1 Overview 


You can use the SIMATIC timer functions to implement timing processes in the pro- 
gram such as waiting and monitoring times, measurement of a time interval, or the 
generation of pulses. The following responses are available for a SIMATIC timer 
function: 


> Pulse generation 

> Extended pulse 

> ON delay 

> Retentive ON delay 
> OFF delay 


A data record which is present in the system data is permanently assigned to each 
SIMATIC timer function; this limits the number of SIMATIC timer functions. 
SIMATIC timer functions are global tags; the symbols are declared in the PLC tag 
table. 


The SIMATIC timer functions run in STARTUP and RUN modes. 


SIMATIC timers as overall function 


The overall function is represented in the programming languages LAD and FBD as 
a box (Fig. 12.13). The box of a timer function contains the related representation 
of all individual timer operations in the form of function inputs and outputs. The 
address of the timer function is named above the box in absolute or symbolic form. 
The timer response is quasi the heading in the box. Assignment of the S and TW in- 
puts is mandatory, assignment of the other inputs and outputs is optional. With 
STL, the individual statements must be programmed in the indicated sequence. 
With SCL, the complete function call corresponds to the overall function. 


SIMATIC timers as single elements 


In the representation as single elements, attention must be paid to the program- 
ming sequence so that the timer function responds as described further below: 
First program the start statement, then the reset statement, and finally scan the 
timer function. If the enabling statement is used with STL, it must be programmed 
prior to the start statement (Fig. 12.14). 


When programming a timer function, you need not use all statements available for 
the timer function. It is sufficient to use the statements required for the desired 
function. In the normal case these are the starting of the timer function with spec- 
ification of the duration and the binary scanning of the timer function. 
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SIMATIC timer functions, representation as total function 


Parameters for LAD and FBD: 


Timer operand 


Function identifier: 


Name | Declaration | Data type | Description 
Function 
—s q— $ INPUT BOOL Start input 
TV INPUT TIME Defined duration 
—_ Bl —— R INPUT BOOL Reset input 
—R BCD — 
Q OUTPUT BOOL Timer status 
Bl OUTPUT TIME Time value integer 
FBD BCD OUTPUT SSTIME Time value BCD 
Timer operand 
Function 
—s = STL Enable input 
—t BCD — FR Timer Spree! 
A Start input 
—# _ L Duration 
FKT Timer operand 
A Reset input 
SCL , ; R Timer operand 
Time value BCD := Function L, Timer operand 
WRG, eS Mauioe iota feel a Time value integer 
iS) = Start input, 
Ty = Duration, LC Timer operand 
R = Reset input, a Time value BCD 
Q = Timer status, A Timer operand 
BI = Time value integer) ; = Timer status 


With LAD and FBD as 


Start of With SCL With STL 
timer function as Box Single element | with with 
Pulse S_PULSE SP S_PULSE SP 
Extended pulse S_PEXT SE S_PEXT SE 

On delay S_ODT SD S_ODT SD 
Retentive on delay S_ODTS Ss S_ODTS SS 

Off delay S_OFFDT SF S_OFFDT SF 


Function chart: 


Start of timer function as 


Start signal | 


Pulse 


Stretched pulse 


On delay 


Retentive on delay 


Off delay 


t = set duration 


Fig. 12.13 SIMATIC timer functions as overall function 
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Representation of a SIMATIC timer function with single elements 


LAD _ Start timer function Scan timer status for "1" 
Timer operand Timer operand 
—( Function }}— ——_ + 
Duration 
Reset timer function Scan timer status for "0 
Timer operand Timer operand 
meas aia —— 
Load time value integer-coded 
MOVE 
——EN ENO — 
Timer operand — |N OUT — Time value 
integer 
FBD Start timer function Scan timer status for "1" 
Timer operand 
Function Timer operand — 
Start input —— 
Duration — : 
wy Scan timer status for "0" 
Reset timer function Timer operand —O 
Timer operand 
R Load time value integer-coded 
Reset input —— 
P MOVE 
—EN OUT — 
Timer operand ——|N ENO — Time value 
integer 
STL : j ; 
‘ The operations of the timer function can 
Enable input b ba qt 
3 e programmed individually. 
FR Timer operand . ? . 
A Start input A duration is always required to start the 
i ; timer function. 
L uration 
FKT Timer operand 
A Reset input 
R Timer operand 
L Timer operand 
Ty Time value integer 
LC Timer operand 
ae Time value BCD 
A Timer operand 
= Timer status 
SCL ra F ; 
; : Individual parameters of the timer function 
Time value BCD := Function /( can be omitted. You only program the 
HINO) p= TiMier eppexaias, parameters which you require. 
ae ee Segue Maes You must always specify the timer operand 
C= 1Dibliheatepaly, T_NO) 
R := Reset input, (TL ‘ ' 
BI => Time value integer, Start input (S) and duration (TV) must 
Q => Timer status); always be handled in pairs. 


Fig. 12.14 SIMATIC timer functions, representation as single elements 
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12.3.2. Programming a timer function 


Starting a timer function 


A timer function is started, for example, using a binary tag. In the figures this tag is 
named Start input. 


A timer function starts (the time starts running) when the signal state of the start 
input changes. Such a change in signal state is always required to start a timer func- 
tion. In the case of an OFF delay, the signal state must change from “1” to “O”, in all 
other cases the time starts when changing from “0” to “1”. 


You can start every timer function using one of five possible responses. However, it 
is not meaningful to assign several responses to one timer function. 


Specification of duration 


When starting, the timer function is loaded with a default value of data type S5- 
TIME. In the figures this default value is named Duration. The duration can be spec- 
ified as a constant or as a tag. 


The duration is calculated internally from the time value and time scale: 
Duration = Time value x Time scale. The duration is the time during which a timer 
function is active (“time running”). The time value represents the number of time 
periods for which the timer function runs. The time scale specifies the interval at 
which the CPU's operating system changes the time value (Fig. 12.15). 


SIMATIC timer function, bit assignments of the duration 


15 2 | 4Al 8 7 4 3 O Bit 
Xx a A +7 A ~~ A ~- J 
102 101 109 
% a ff 


Time value specified in BCD 


Time scale specified in BCD: 0=0.01s 
1=0.1s 
2=1s 
3=10s 


Fig. 12.15 Bit assignment of the duration with a SIMATIC timer function 


You can also directly establish the duration in a word operand. The smaller you se- 
lect the time scale, the more exact is the actually processed duration. For example, 
if you wish to implement a duration of one second, three possibilities exist: 


Duration = W#16#2001 Time scale 1s 
Duration = W#16#1010 Time scale 100 ms 
Duration = W#16#0100 Time scale 10 ms 


The last possibility should be preferred in this example. 
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When starting the timer function, the CPU applies the programmed time value. The 
operating system updates the timer functions at a fixed interval and independent 
of processing of the user program, i.e. with active timers it counts down the count 
value at the interval of the time scale. The time is considered to be expired when a 
value of zero is reached. The CPU then sets the timer status (signal state “O” or “1” 
depending on time response) and omits all further activities until the timer func- 
tion is started again. If you enter a value of zero (0 ms or W#16#0000) for the dura- 
tion when starting a timer function, the timer function remains active until the CPU 
has processed the timer function and established that the time has expired. 


The timer functions are updated asynchronous to program execution. It may there- 
fore occur that the timer status at the beginning of the cycle has a different value 
from that at the end. If you only use the timer operations at one position in the pro- 
gram, no malfunctions can occur due to asynchronous time updating. 


Resetting a timer function 


A timer function is reset, for example, using a binary tag. In the figures, this tag is 
named Reset input. 


A timer function is reset as long as the reset input has signal state “1”. Resetting of 
the timer function sets the time value and the time scale to zero and the timer status 
to “O”. Starting of the timer function is not possible for as long as the reset is pres- 
ent. 


Note with STL: Resetting a timer function does not reset the internal edge trigger 
flag for starting. To start again, the start operation must first be processed with 
RLO “0” before the timer function can be started with a signal edge. You can also use 
enabling of the timer function for this. 


Scanning the timer status 


The timer status is as it were the “result” of the timer function. Its time response is 
based on the response of the timer function. For example, the timer status can be 
assigned to a binary tag. In the figures this tag is named Timer status. 


The time response of the timer status is shown in general in Fig. 12.13 and 
described in detail further below in the descriptions of the responses of a timer 
function. 


Scanning the current time value BCD-coded 


The time value is the current value of the “remaining time” at the time of scanning. 
With a timer function running, the time value is counted down from the defined du- 
ration to zero. In the BCD-coded form, the remaining time contains the time scale 
and duration in data type WORD or S5TIME. In the figures, this tag is named Time 
value BCD. 


Scanning the current time value integer-coded 


The time value is the current value of the “remaining time” at the time of scanning. 
With a timer function running, the time value is counted down from the defined du- 
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ration to zero. In the integer-coded form, the remaining time only delivers the cur- 
rent magnitude of the time value, the time scale is not included. In the figures, this 
tag is named Time value integer with data type INT. 


Enabling a timer function 


Arunning time is “re-triggered” by enabling, i.e. a restart is triggered. Enabling is 
only available in the programming language STL,; it is not required to start or reset 
a timer function, i.e. for normal execution. 


Enabling is triggered by a positive edge at the enabling operation, for example by a 
binary tag. In the figures, this tag is named Enable input. 


Enabling resets the internal edge trigger flag for starting the timer function. If the 
result of logic operation is “1” during the next processing of the start operation, the 
timer function is started again. 


Example: A timer function is started as a pulse time by a positive edge at the start 
input. The start input remains permanently at signal state “1”. The time can then 
be restarted by a positive edge at the enable input without resulting in a change in 
the signal state at the start input. It is irrelevant whether the time is still running 
or has already expired. 


12.3.3 Timer response as pulse 


Starting a pulse time 


The diagram in Fig. 12.16 describes the response of the timer function following 
starting as pulse and when resetting. 


@_ The timer function starts if the signal state at its start input changes from “0” 
to “1” (positive edge). It runs for the programmed duration as long as the signal 
state at the start input remains “1”. The scans for signal state “1” (the timer status) 


Timer response with starting as pulse 


@ 2) ® i) © 


Start input 


Reset input 


Timer status 


Elapsed 
time 


= specified duration 


Fig. 12.16 Timer response with starting and resetting as pulse 
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deliver the result of scan “1” for as long as the time is running. The time value is 
counted down from the start value according to the set scale. 


@ The timer function stops if the signal state at its start input changes to “0” be- 
fore the time has expired. The scan of the timer function for signal state “1” (the 
timer status) then delivers the result of scan “O”. The time value indicates the re- 
maining duration by which the time was interrupted too early. 


Resetting a pulse time 


Resetting a pulse time has a static effect and has priority over starting of the timer 
function (Fig. 12.16). 


@ Signal state “1” at the reset input of the timer function with the time running 
resets the timer function. A scan for signal state “1” (the timer status) then delivers 
the result of scan “0”. The time value and the time scale are also set to zero. If the 
signal state at the reset input changes from “1” to “O” while signal state “1” is still 
present at the start input, the timer function remains unaffected. 


@ Ifthe time is not running, signal state “1” at the reset input has no effect. 


© Ifareset signal is present and the signal state at the start input changes from 
“0” to “1” (positive edge), the timer function is started but the subsequent reset im- 
mediately resets it again (indicated by a line in the diagram). If the scan of the timer 
status is programmed following the reset, the brief starting does not influence the 
scan of the timer function. 


Enabling a pulse time 


Enabling is only possible in the programming language STL. The diagram in Fig. 
12.17 shows enabling of a timer function started as a pulse. 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is running, the time for processing of the start operation restarts as 
long as signal state “1” is still present at the start input. With this restart, the pro- 


Enable with starting as pulse 


oO 2) 13] 


Start input 


Enable input 


Timer status 


ae 


Elapsed t 
time 


t = specified duration 


Fig. 12.17 Enabling with a pulse time 
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grammed duration is applied as the current time value. A change in the signal state 
at the enable input from “1” to “0” has no effect. 


@® Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is not running and signal state “1” is still present at the start input, 
the timer function also starts with the programmed duration as pulse. 


© Withsignal state “O” at the start input, a positive signal edge at the enable input 
has no effect. 


12.3.4 Timer response as extended pulse 


Starting as extended pulse 


The diagram in Fig. 12.18 describes the response of the timer function following 
starting as extended pulse and when resetting. 


@@® _ The timer function starts if the signal state at its start input changes from “0” 
to “1” (positive edge). It runs for the programmed duration even if the signal state 
at the start input returns to “O”. The scans for signal state “1” (the timer status) de- 
liver the result of scan “1” for as long as the time is running. The time value is 
counted down from the start value according to the set scale. 


@ The timer function starts again with the programmed time value (the timer 
function is “retriggered”) if the signal state at the start input changes from “0” to 
“1” (positive edge) while the time is running. It can be restarted any number of 
times without expiring. 


Resetting with extended pulse 


Resetting a time started as a extended pulse has a static effect and has priority over 
starting of the timer function (Fig. 12.18). 


Timer response with starting as extended pulse 
@ 2) ® @® ® © @ 


+t +t <+{t>| <+t> <= t>| <tt> 


Start input 


Reset input 


Timer status 


Elapsed ¢ 
time 


t = specified duration 


Fig. 12.18 Timer response as extended pulse 
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@@® Signal state “1” at the reset input of the timer function with the time running 
resets the timer function. A scan for signal state “1” (timer status) delivers the re- 
sult of scan “0” if the timer function is reset. The time value and the time scale are 
also set to zero. 


© Processing of the reset input with signal state “1” has no effect when the time 
is not running. 


@ Ifareset signal is present and the signal state at the start input changes from 
“0” to “1” (positive edge), the timer function is started but the subsequent reset im- 
mediately resets it again (indicated by a line in the diagram). If the scan of the timer 
status is programmed following the reset, the brief starting does not influence the 
scan of the timer function. 


Enabling with extended pulse 


Enabling is only possible in the programming language STL. The diagram in Fig. 
12.19 shows enabling of a timer function started as a extended pulse. 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is running, the time for processing of the start operation restarts as 
long as signal state “1” is still present at the start input. With this restart, the pro- 
grammed duration is applied as the current time value. A change in the signal state 
at the enable input from “1” to “O” has no effect. 


® Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is not running and signal state “1” is still present at the start input, 
the timer function also starts with the programmed duration as extended pulse. 


©®@ Withsignal state “0” at the start input, a positive signal edge at the enable in- 
put has no effect. 


Enable with starting as extended pulse 
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Fig. 12.19 Enabling with extended pulse 
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12.3.5 Timer response as ON delay 


Starting as ON delay 


The diagram in Fig. 12.20 describes the response of the timer function following 
starting as ON delay and when resetting. 


Timer response with starting as on delay 
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t = specified duration 


Fig. 12.20 Timer response as ON delay 


@_ The timer function starts if the signal state at its start input changes from “0” 
to “1” (positive edge). It expires with the programmed duration. The scans for sig- 
nal state “1” (timer status) deliver the result of scan “1” if the time has expired cor- 
rectly and the start input is still controlled by signal state “1” (delayed switch-on). 
The time value is counted down from the start value according to the set scale. 


@ The timer function stops if the signal state at the start input changes from “1” 
to “O” while the time is running. A scan of the timer function for signal state “1” 
(timer status) always delivers the result of scan “0” in such cases. The time value in- 
dicates the remaining duration by which the time was interrupted too early. 


Resetting as ON delay 


Resetting an ON delay has a static effect and has priority over starting of the timer 
function (Fig. 12.20). 


Signal state “1” at the reset input resets the timer function irrespective of 
whether the time is running or not. A scan for signal state “1” (timer status) then 
delivers the result of scan “O” even if the time is not running and the signal state “1” 
is still present at the start input. The time value and the time scale are also set to 
zero. If the signal state at the reset input changes from “1” to “0” while signal state 
“1” is still present at the start input, the timer function remains unaffected. 


© Ifareset signal is present and the signal state at the start input changes from 
“0” to “1” (positive edge), the timer function is started but the subsequent reset im- 
mediately resets it again (indicated by a line in the diagram). If the scan of the timer 
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status is programmed following the reset, the brief starting does not influence the 
scan of the timer function. 


Enabling as ON delay 


Enabling is only possible in the programming language STL. The diagram in Fig. 
12.21 shows enabling of a timer function as ON delay. 


Enable with starting as on delay 
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Fig. 12.21 Enabling with ON delay 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is running, the time for processing of the start operation restarts as 
long as signal state “1” is still present at the start input. With this restart, the pro- 
grammed duration is applied as the current time value. A change in the signal state 
at the enable input from “1” to “O” has no effect. 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
when the time has expired correctly, the timer function remains uninfluenced 
when the start operation is processed. 


©@ With the timer function reset, a positive signal edge at the enable input re- 
starts the timer function if signal state “1” is still present at the start input. This re- 
start takes over the programmed duration as current time value. 


With signal state “O” at the start input, a positive edge at the enable input has no 
effect. 


12.3.6 Timer response as retentive ON delay 


Starting as retentive ON delay 


The diagram in Fig. 12.22 describes the response of the timer function following 
starting and when resetting. 
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Timer response with starting as retentive on delay 
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Fig. 12.22 Timer response as retentive ON delay 


@@® _ The timer function starts if the signal state at its start input changes from “0” 
to “1” (positive edge). It runs for the programmed duration even if the signal state 
at the start input returns to “0”. If the time has expired, a scan of the timer function 
for signal state “1” (timer status) delivers the result of scan “1” independent of the 
signal state at the start input. The result of scan only becomes “O” again if the timer 
function has been reset, independent of the signal state at the start input. The time 
value is counted down from the start value according to the set scale. 


@ The timer function starts again with the programmed time value (the timer 
function is “retriggered”) if the signal state at the start input changes from “0” to 
“1” (positive edge) while the time is running. It can be restarted any number of 
times without expiring. 


Resetting as retentive ON delay 


Resetting a retentive ON delay has a static effect and has priority over starting of 
the timer function (Fig. 12.22). 


Signal state “1” at the reset input resets the timer function independent of 
the signal state at the start input. The scans of the timer function for signal state “1” 
(timer status) then deliver the result of scan “0”. The time value and the time scale 
are set to zero. 


© Ifareset signal is present and the signal state at the start input changes from 
“0” to “1” (positive edge), the timer function is started but the subsequent reset im- 
mediately resets it again (indicated by a line in the diagram). If the scan of the timer 
status is programmed following the reset, the brief starting does not influence the 
scan of the timer function. 
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Enabling as retentive ON delay 


Enabling is only possible in the programming language STL. The diagram in Fig. 
12.23 shows enabling of a timer function started as a retentive ON delay. 


Enable with starting as retentive on delay 
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Fig. 12.23 Enabling with retentive ON delay 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
while the time is running, the timer function for processing of the start operation 
restarts as long as signal state “1” is still present at the start input. With this restart, 
the timer function takes over the programmed duration as the current time value. 
A change in the signal state at the enable input from “1” to “O” has no effect. 


@® Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
when the time has expired correctly, the timer function remains uninfluenced 
when the start operation is processed. 


© Withsignal state “0” at the start input, a positive signal edge at the enable input 
has no effect. 


@®©@ With the timer function reset and signal state “1” at the start input, a positive 
edge at the enable input restarts the timer function. This restart takes over the pro- 
grammed duration as current time value. 


12.3.7 Timer response as OFF delay 


Starting as OFF delay 


The diagram in Fig. 12.24 describes the response of the timer function following 
starting as OFF delay and when resetting. 


489 


12 Basic functions 


Timer response with starting as off delay 
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Fig. 12.24 Timer response as OFF delay 


@@® _ The timer function starts if the signal state at its start input changes from “1” 
to “O” (negative edge). It expires with the programmed duration. The scans of the 
timer function for signal state “1” (timer status) deliver the result of scan “1” if the 
signal state at the start input is “1” or if the time is running (delayed switch-off). 
The time value is counted down from the start value according to the set scale. 


@ _ The timer function is reset if the signal state at its start input changes from “0” 
to “1” (positive edge) while the time is running. Only a negative edge at the start 
input restarts the time. 


Resetting as OFF delay 


Resetting an OFF delay has a static effect and has priority over starting of the timer 
function (Fig. 12.24). 


@ Signal state “1” at the reset input of the timer function with the time running 
resets the timer function. The result of scans for signal state “1” (timer status) is 
then “0”. The time value and the time scale are also set to zero. 


Signal state “1” at the start input and at the reset input resets the binary out- 
put of the timer function (a scan of the timer function for signal state “1”, the timer 
status, then delivers the result of scan “O”). If the signal state at the reset input then 
changes to “0” again, the output of the timer function has signal state “1” again. 


@ Ifareset signal is present and the signal state at the start input changes from 
“1” to “0” (negative edge), the timer function is started but the subsequent reset im- 
mediately resets it again (indicated by a line in the diagram). The scan for signal 
state “1” (the timer status) then immediately delivers the result of scan “0”. 


Enabling as OFF delay 


Enabling is only possible in the programming language STL. The diagram in Fig. 
12.25 shows enabling of a timer function started as an OFF delay. 
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Enable with starting as off delay 
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Fig. 12.25 Enabling with OFF delay 


@ Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
when the time is not running, the timer function remains uninfluenced when the 
start operation is processed. A change in the signal state at the enable input from 
“1” to “O” has no effect either. 


@® Ifthe signal state at the enable input changes from “0” to “1” (positive edge) 
when the time is running, the timer function restarts when the start operation is 
processed. This restart takes over the programmed duration as current time value. 


© Achange in the signal state at the enable input from “0” to “1” (positive edge) 
or a change in the signal state from “1” to “O” (negative edge) with the time not run- 
ning has no effect. 


12.4 IEC timer functions 


12.4.1 Introduction 


The timer functions described below are referred to as “IEC timer functions” in or- 
der to distinguish them from the “SIMATIC timer functions” additionally present 
with SIMATIC S7-300/400. 


You can use the timer functions to implement timing processes in the program 
such as waiting and monitoring times, measurement of a time interval, or the gen- 
eration of pulses. The following IEC timer functions are available: 


> TP Pulse generation (SFB 3) 
> TON ON delay (SFB 4) 
> TOF OFF delay (SFB 5) 
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With a CPU 400, an IEC timer function is implemented as a system function block 
(SFB). When programming a timer function, you specify the data block in which the 
data is to be saved. If you select the Single instance button, it must be a different da- 
ta block each time. If you program a timer function in a function block, you can also 
select Multi-instance. In this case the data of the timer function is saved as local in- 
stance in the instance data block of the function block. 


When calling a timer function you must supply the start input IN and the defined 
duration PT (preset time) with tags. Supplying of the timer status Q and the elapsed 
time ET is optional. 


The timer functions run in STARTUP and RUN modes. 


12.4.2 Pulse generation TP 


The pulse generation shortens or extends an input signal to the programmed dura- 
tion (Fig. 12.26). 


The timer function starts if the signal state at its start input IN changes from “0” to 
“1”. It runs for the duration programmed at the PT input, independent of the fur- 
ther response of the signal state at the start input. The Q output delivers signal state 
“1” for as long as the time is running @ @ @@. 


Pulse generation TP 


Instance data Instance data Name | Declaration | Data type | Description 
LAD T FBD TP IN INPUT BOOL Start input 
Time Time PT INPUT TIME Defined duration 
—IN o—- —h ET——~ Q ouTpuT | BOOL Timer status 
— ——_ — ie ma— ET OUTPUT TIME Elapsed time 
STL Calling as a single instance: SCL Calling as a single instance: 
CALL TP,"Instance DB" "Instance DB".TP ( 
Time IN := Start input, 
IN := Start input PT := Duration, 
PT := Duration Q => Timer status, 
Q = Timer status ET => Time value); 
ET := Time value 


0) ® 


® 2) 
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Timer status 
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Elapsed time 


t = specified duration PT 


Fig. 12.26 Pulse generation TP, representation and function 
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The ET output delivers the expired time. This duration commences at T#0s and 
ends at the preset time PT. If the time has expired, ET remains at the expired value 
until the signal state at the IN input changes again to “0” @ @. If the IN input has 
signal state “O” prior to expiry of the preset time PT, the ET output immediately 
changes to T#0s following expiry of PT@©@. 


12.4.3 ON delay TON 
The ON delay delays an input signal by the programmed duration (Fig. 12.27). 


@ @ The timer function starts if the signal state at its start input IN changes from 
“O” to “1”. It expires with the duration programmed at the PT input. The Q output 
delivers signal state “1” if the time has expired and for as long as the start input is 
still “1”. 


@@©@ The time is reset if the signal state at the start input IN changes from “1” to “0” 
before the time has expired. It starts again with the next positive edge at the 
IN input. 


The ET output delivers the expired time. This duration commences at T#0s and 
ends at the preset time PT. If PT has expired, ET remains at the expired value until 
the IN input changes again to “0” @) @. If the IN input has signal state “O” prior to 
expiry of PT, the ET output immediately changes to T#0s @ @) @. 


On delay TON 


Instance data Instance data Name | Declaration | Data type | Description 
LAD TON FBD TON IN INPUT BOOL Start input 
Time Time PT INPUT TIME Defined duration 
—IN c- —t ET—~ Q outTpuT | BOOL Timer status 
—i Eig—_ —— Pil Q— ET OUTPUT TIME Elapsed time 
STL Calling as a single instance: SCL Calling as a single instance: 
CALL TON,"Instance DB" "Instance DB".TON 
Time IN := Start input, 
IN := Start input PT := Duration, 
PT := Duration Q => Timer status, 
Q = Timer status ET => Time value); 
ET := Time value 
@ ®@ ® @ 


Start input 
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Timer status 
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t = specified duration PT 


Fig. 12.27 ON delay TON, representation and function 
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12.4.4 OFF delay TOF 


The OFF delay delays the switching off of an input signal by the programmed dura- 
tion (Fig. 12.28). 


Off delay TOF 


CALL TOF,"Instance DB" 


Instance data Instance data Name | Declaration | Data type | Description 
LAD TOF FBD TOF IN INPUT BOOL Start input 
Time Time PT TIME Defined duration 
—_ ._ =| te) outpuT |BOOL | Timer status 
Pil —— —i oe— ET OUTPUT TIME Elapsed time 
STL Calling as a single instance: SCL Calling as a single instance: 


"Instance DB".TOF 


Time IN := Start input, 
IN := Start input PT := Duration, 

PT := Duration Q => Timer status, 
Q = Timer status ET => Time value); 
ET := Time value 


Start input 


Timer status 


Elapsed time 


t = specified duration PT 


Fig. 12.28 OFF delay TOF, representation and function 


@ @® The Q output has signal state “1” if the signal state at the start input IN of the 
timer function changes from “0” to “1”. If the signal state at the start input returns 
to “O”, the time starts with the duration programmed at the PT input. The Q output 
remains at signal state “1” for as long as the time is running. The Q output is reset 
if the time has expired. 


@ The duration is reset and the Q output remains “1” if the signal state at the start 
input changes to “1” again before the time has expired. 


The ET output delivers the expired time. This duration commences at T#0s and 
ends at the preset time PT. If PT has expired, ET remains at the expired value until 
the IN input has signal state “1” @. If the IN input has signal state “1” prior to expiry 
of PT, the ET output immediately changes to T#0s @. 
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12.5 SIMATIC counter functions 


12.5.1 Overview 


You can use the SIMATIC counter functions to execute counting tasks directly using 
the CPU. The counter functions can count up and down; the numerical range ex- 
tends over three decades (000 to 999). 


The counting frequency of these counter functions depends on the execution time 
of your program. In order to count, the CPU must recognize a change in the signal 
state of the input pulse, i.e. an input pulse (or a pause) must be present for at least 
one program cycle. The longer the program execution time, the lower the counting 
frequency. 


The following responses are available for a SIMATIC counter function: 


> Up counter 
> Down counter 


> Up/down counter 


A data record which is present in the system data is permanently assigned to each 
SIMATIC counter function; this limits the number of SIMATIC counter functions. 
SIMATIC counter functions are global tags; the symbols are declared in the PLC tag 
table. 


The SIMATIC counter functions run in STARTUP and RUN modes. 


Note: The FM 450-1 function module also contains counter functions. It has sepa- 
rate inputs for 5 V or 24 V incremental encoders and can count up to a frequency of 
500 kHz. 


SIMATIC counters as overall function 


The overall function is represented in the programming languages LAD and FBD as 
a box (Fig. 12.29). The box of a counter function contains the related representation 
of all individual counter operations in the form of function inputs and outputs. The 
address of the counter function is named above the box in absolute or symbolic 
form. The counter response is quasi the heading in the box. Assignment of the first 
box input is mandatory, assignment of the other inputs and outputs is optional. 
With STL, the individual statements must be programmed in the indicated se- 
quence. With SCL, the complete function call corresponds to the overall function. 


SIMATIC counters as single elements 


In the representation as single elements, attention must be paid to the program- 
ming sequence so that the counter function responds as described later in this 
book: First program the count up and count down statement, then the set state- 
ment, followed by the reset statement, and finally scan the counter function. If the 
enabling statement is used with STL, it must be programmed prior to the counter 
statement (Fig. 12.30). 
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SIMATIC counter functions, representation as total function 


LAD Counter operand Parameters for LAD and FBD: 
Function Name _ | Declaration | Data type | Description 
— ‘ CU INPUT BOOL Count up input 
—To CV — cD INPUT BOOL Count down input 
—s cCWBCD— S INPUT BOOL Set input 
— PV 
— PV INPUT WORD Preset count value 
R INPUT BOOL Reset input 
Q OUTPUT BOOL Counter status 
EBD cv OUTPUT WORD Count value integer 
Counter operand CV_BCD | OUTPUT WORD Count value BCD 


Function 
—cu LAD: The representation shows an up/down counter S CUD 
The CD parameter is omitted with the up counter S_CU, and 
—cD the CU parameter with the down counter S_CD. 
— 5 v— 
—PV cCV_BCD— FBD: The representation shows an up/down counter ZAEHLER. 
—R -'- The CD parameter is omitted with the up counter S_CU, and 


the CU parameter with the down counter S_CD. 


Function identifier: 


With LAD and FBD as With SCL With STL 
Box Single element with with 
Up counter S_CU CU S_CU CU 
Down counter S_CD CD S_CD CD 
Up/down counter S_CUD CU + CD S_CUD CU + CD 
STL i Enable input; STL: The representation shows an up/down counter. 
FR Counter operand; With the up counter you omit the counting down, with the 
aA Count up; down counter you omit the counting up. 
CU Counter operand; 
A Count down; 
cD Counter operand; 


A Set input; 

L Count value; 

8 Counter operand; 

A Reset input; 

R Counter operand; 

L Counter operand; 

a Count value integer; 


LG: Counter operand; 
av Count value BCD; 
A Counter operand; 


= Counter status; 


SCL 


Count value BCD := Function( SCL: The representation shows an 
Cc NO := Counter operand, up/down counter S_CUD. 
cu := Count up, The CD parameter is omitted with the 
CD := Count down, up counter S_CU, and the 
§ := Set input, CU parameter with the down 
PV := Count value, counter S_CD. 
R := Reset input, 
Q => Counter status, 
CW => Count value integer); 


Fig. 12.29 SIMATIC counter functions as overall function 
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Representation of a SIMATIC counter function with single elements 
LAD 


Count up Count down Set counter function Reset counter function 
Counter operand Counter operand Counter operand Counter operand 
—{c}—— _ —{o}#—_—§ —{s #— ——{r}— 
Count value 
Scan counter Scan counter Load count value integer-coded 
status for "1 status for "0 MOVE 
Counter operand Counter operand —EN ENO — 
| |-—_—- a Counter — jj OUT — Count 
operand value integer 
FBD Count up Count down 
Counter operand Counter operand 
CU cD 
Count up — Count down — 
Set counter function Reset counter function 
Counter operand Counter operand 
s R 
Set input —= Reset input — 
Count value— PV 
Load count value integer-coded 
Scan counter status for"1" and "0" 
MOVE 
Counter operand —— —EN ouUT — 
Counter operand -O Counter IN ENO — Count 
operand value integer 
STL A Enable input; : 7 
: The operations of the counter function can be 
FR Counter operand; programmed individually. 
A Count up; A count value is always required to set the 
cu Counter operand; counter function. 
A Count down; 
cD Counter operand; 
A Set input; 
L Count value; 
Ss Counter operand; 
A Reset input; 
R Counter operand; 
L Counter operand; 
aE Count value integer; 
LC Counter operand; 
T Count value BCD; 
A Counter operand; 
= Counter status; 
SCL Roc ene en Individual parameters of the counter 
Cc NO := Counter operand, function can be omitted. You only program 
cu := Count up, the parameters which you require. 
cD := Count down, You must always specify the counter 
s p= Sele dnswe, operand (C_NO). 
PV := Count value, Set input (S) and count value (PV) must 
Rp := Reset input, always be handled in pairs. 
(0) => Counter status, 
CV => Count value integer); 


Fig. 12.30 SIMATIC counter functions, representation as single elements 
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When programming a counter function, you need not use all statements available 
for the counter function. It is sufficient to use the statements required for the de- 
sired function. In the normal case these are the count up or count down function, 
setting of the counter function with specification of the count value, and the binary 
scanning of the counter status. 


12.5.2 Programming a counter function 


Count up 


A counter function is counted up, for example, using a binary tag. In the figures, 
this tag is named Count up. 


Each positive edge when counting up increments the count value by one unit until 
the upper limit of 999 is reached. Any further positive edges for counting up then 
have no effect. Carrying forward does not take place. 


Count down 


A counter function is counted down, for example, using a binary tag. In the figures, 
this tag is named Count down. 


Each positive edge when counting down decrements the count value by one unit 
until the lower limit of 0 is reached. Any further positive edges for counting down 
then have no effect. Counting with a negative count value does not take place. 


Set counter function 


A counter function is set to a default value, for example, using a binary tag. In the 
figures, this tag is named Set input. 


With a positive edge at the set input, the default value is transferred to the counter. 


Specification of count value 


When setting, the counter function is loaded with a default value of data type WORD 
(BCD16 in the range from W#16#0000 to W#16#0999). In the figures, this tag is 
named Count value. 


Fig. 12.31 shows the bit assignment of the count value. 


SIMATIC counter function, bit assignments of the count value 


15 12 | i 8 | 7 A | 3 0 Bit 
Xv ~- A +7 A ~~ A ~~ J 
0 102 101 100 
» 7 J 


Count value specified in BCD 


Fig. 12.31 Bit assignment of the count value of a SIMATIC counter 
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Reset counter function 


A counter function is reset, for example, using a binary tag. In the figures, this tag 
is named Reset input. 


A counter function is reset as long as the reset input has signal state “1”. Resetting 
of the counter function sets the count value to zero and the counter status to “0”. 
Setting, counting up, and counting down of the counter function is not possible for 
as long as the reset is present. 


Note with STL: Resetting a counter function does not reset the internal edge trigger 
flags for setting, counting up, and counting down. To set, count up or count down 
again, the corresponding operation must first be processed with RLO “0” before the 
counter function detects a signal edge. You can also use enabling of the counter 
function for this. 


Scan counter status 


The counter status indicates with signal state “1” that the current count value is 
greater than zero. With a count value of zero, the counter status has signal state “O”. 
For example, the counter status can be assigned to a binary tag. In the figures, this 
tag is named Counter status. 


Scanning the current count value BCD-coded 


The count value is the current counter value at the time of scanning. It can be as- 
signed, for example, to a tag with data type WORD. In the figures, this tag is named 
Count value BCD. The range of values is from W#16#0000 to W#16#0999. 


Scanning the current count value integer-coded 


The count value is the current counter value at the time of scanning. It can be as- 
signed, for example, to a tag with data type INT. In the figures, this tag is named 
Count value integer. The range of values is from 0 to +999. 


12.5.3 Principle of operation of a counter function 
Fig. 12.32 shows the principle of operation of the SIMATIC counter function. 
@ The counter is at a count value of zero. The counter status has signal state “O”. 


® A positive edge at the count up input increments the count value by one unit 
to 1. 


© A positive edge at the count up input increments the count value by one unit 
to 2. 


© The positive edge at the set input sets the counter to the specified count value 
of 4. 
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A positive edge at the count up input increments the count value by one unit 
to 5. 


One positive edge each at the count up and count down inputs result in the end 
that the count value does not change. 


The positive edge at the count down input decrements the count value by one 
unit to 4. 


The positive edge at the count down input decrements the count value by one 
unit to 3. 


Signal state “1” at the reset input resets the counter function. The count value 
is set to 0 and the counter status has signal state “0”. 


Counting down with a count value of 0 has no effect. 


With a positive edge at the set input, the count value is set to 4. The counter sta- 
tus has signal state “1”. 


@ 68° 0 6 8 0 @ 


The positive edge at the count up input increments the count value by one unit 
to 5. 


Functional principle of a SIMATIC counter 


o0UucO8mUCOOCUCOWUCOUCOFCtE C—- —_D_—sC DC 
Count up CU 


Count down CD 


ee Ee i 


Set input S 


Reset input R 


Specified count 
value PV 


Actual count 
value 


Counter 


Fig. 12.32 Principle of operation of a SIMATIC counter function 


The sequence of counter statements upon which the example is based can be ob- 
tained from Fig. 12.30 on Page 497. 
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12.5.4 Enabling a counter function with STL 


As a result of enabling, setting as well as counting up and down are executed even 
without a positive signal edge at the corresponding inputs. This is only possible if 
the corresponding operation continues to be processed with RLO “1”. Enabling is 
only present in the programming language STL; it is not required for setting, reset- 
ting or counting, i.e. for normal execution. 


Enabling is triggered by a positive edge at the enabling operation, for example by a 
binary tag. In the figure, this tag is named Enable input. 


Enabling resets the internal edge trigger flags for setting and counting. If the result 
of logic operation is “1” with the next processing at the set, count up or count down 
input, the corresponding function is executed again. 


Enabling a SIMATIC counter function 


@ @ ©) @ © @ 


Enable input 
Count up 
Count down 


© 
Set input = 


Reset input 


Counter status 
Counter value 20 21 22 21 21 20 0 20 


Fig. 12.33 Enabling a SIMATIC counter function 


Note: Enabling has a quasi-simultaneous effect on setting, counting up, and count- 
ing down! Attention must therefore be paid to the sequence of set and count oper- 
ations. 


The following example explains the principle of operation of enabling at the inputs 
of the counter function (Fig. 12.33): 


@ The positive edge at the set input sets the counter to the start value 20. 
@ A positive edge at the count up input increments the count value by one unit. 


@® Since the signal state at the count up inputis “1”, the count value is incremented 
by one unit when enabled. 


@ The positive edge at the count down input decrements the count value by one 
unit. 
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© Counting up and down are executed as a result of enabling since signal state “1” 
is present at both inputs. 


© The positive edge at the set input sets the counter function to the start value 20. 


@ Signal state “1” at the reset input resets the counter function. The scan of the 
counter function for signal state “1” delivers the result of scan “0”. 


Since signal state “1” is still present at the set input, enabling results in the 
counter function being set to 20 again. The scan for signal state “1” now delivers 
the result of scan “1”. 


The sequence of counter statements upon which the example is based can be 
obtained from Fig. 12.30 on Page 497. 


12.6 IEC counter functions 


12.6.1 Introduction 


The counter functions described below are referred to as “IEC counter functions” in 
order to distinguish them from the “SIMATIC counter functions” additionally pres- 
ent with SIMATIC S7-300/400. 


You can use the counter functions to execute counting tasks directly using the CPU. 
The counter functions can count up and down; the numerical range corresponds to 
the set data type. The counting frequency of the counter functions depends on the 
execution time of your program. In order to count, the CPU must recognize a 
change in the signal state of the input pulse, i.e. the input pulse and the pause must 
be present for at least one program cycle. The longer the program execution time, 
the lower the counting frequency. 


The following counter functions are available: 
> CTU Up counter (SFB 0) 

> CTD Down counter (SFB 1) 

> CTUD  Up/down counter (SFB 2) 


With a CPU 400, an IEC counter function is implemented as a system function block 
(SFB). When programming a counter function, you specify the data block in which 
the data is to be saved. If you select the Single instance button, it must be a different 
data block each time. If you program a counter function in a function block, you can 
also select Multi-instance. In this case the data of the counter function is saved as lo- 
cal instance in the instance data block of the function block. 


When calling a counter function you must supply a start input and the defined 
count value PV (preset value) with tags. Supplying of the counter status Q and the 
current count value CV is optional. 


The counter functions run in STARTUP and RUN modes. 


The counting range corresponds to the INT data format and ranges from -32 768 to 
+32 767. 
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12.6.2 Up counter CTU 


If the signal state at the count up input CU changes from “0” to “1” (positive edge), 
the current count value is incremented by 1 and is indicated at the CV output. If the 
current count value reaches the upper limit of the set data type, it is no longer in- 
cremented. A positive edge at CU then has no effect (Fig. 12.34). 


Up counter CTU 


“ay Instance name ca Instance name Name| Declaration | Datatype | Description 
ps ae CU INPUT BOOL Count up input 
R INPUT BOOL Reset input 
— o— — eu PV INPUT INT Specified count value 
8 Cv — —R Q— Q OUTPUT BOOL Counter status 
— hy — WV— cw OUTPUT INT Actual count value 
STL Calling as a single instance: SCL Calling as a single instance: 
CALL CTU,"Instance DB" "Instance DB".CTU ( 
Int CU := Count up, 
CU := Count up R = Reset input, 
R = Reset input PV := Default value, 
PV := Default value Q => Counter status, 
Q = Counter status CV => Count value); 
CV := Count value 


Count up 
input CU HHEEEHHH iH | 


Reset 


input R B 


6 


Specified count 
value PV 


Actual count 
value CV 


Counter 


status Q ————————_ 7 — 


Fig. 12.34 Up counter CTU, representation and function 


The count value is reset to zero if the reset input R has signal state “1”. A positive 
edge at the CU input has no effect for as long as the R input has signal state “1”. 


The Q output has signal state “1” if the current count value is greater than or equal 
to the specified count value (CV > PV). 
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12.6.3. Down counter CTD 


If the signal state at the count down input CD changes from “0” to “1” (positive 
edge), the current count value is decremented by 1 and is present at the CV output. 
If the current count value reaches the lower limit of the selected data type, it is no 
longer decremented. A positive edge at CD then has no effect (Fig. 12.35). 


Down counter CTD 


jAstancenane jastanee name Name |Declaration | Data type Description 
LAD cTp FBD cTp cD INPUT BOOL Count down input 
INT INT LD INPUT BOOL Load input 
—op Q— —op PV INPUT INT Specified count value 
—ILpb cv — —ILpb Q— Q OUTPUT BOOL Counter status 
— pv —pyv wo wv OUTPUT INT Actual count value 
STL Calling as a single instance: SCL Calling as a single instance: 
CALL CTD,"Instance DB" "Instance DB".CTD ( 
Int CD := Count down, 
CD := Count down LD := Load input, 
LD := Load input PV := Default value, 
PV := Default value Q => Counter status, 
QO = Counter status CV => Count value); 
CV := Count value 


Count down 
input CD fH HE SE | HH | 
Load 


input LD a ns 


Specified count 
value PV 


Current count 
value CV 0 


Counter 
status Q || = 


Fig. 12.35 Down counter CTD, representation and function 


The count value CV is set to the specified count value PV if the LD input has signal 
state “1”. A positive edge at the CD input has no effect for as long as the LD input has 
signal state “1”. 


The Q output has signal state “1” if the current count value is less than or equal to 
zero (CV <0). 
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12.6.4 Up/down counter CTUD 


If the signal state at the count up input CU changes from “0” to “1” (positive edge), 
the count value is incremented by 1 and is indicated at the CV output. If the signal 
state at the count down input CD changes from “0” to “1” (positive edge), the count 
value is decremented by 1 and is present at the CV output. If both count inputs have 
a positive edge, the current count value is not changed (Fig. 12.36). 


Up/down counter CTUD 


jastancenaiie iastance nani’ Name} Declaration | Datatype | Description 
LAD cTup FBD ctup CU INPUT BOOL Count up input 
INT INT CD INPUT BOOL Count down input 
—cu Qu — —cu R INPUT BOOL Reset input 
—cp QD — —cp LD INPUT BOOL Load input 
—R cv — —RrR Qp — PV INPUT INT Specified count value 
—ID —Ip vw— QU OUTPUT BOOL Count up status 
— py — py Qu — QD OUTPUT BOOL Count down status 
CV OUTPUT INT Actual count value 
STL Calling as a single instance: SCL Calling as a single instance: 
CALL CTUD,"Instance DB" "Instance DB".CTUD ( 
Int CU := Count up, 
CU := Count up CD := Count down, 
CD := Count down R = Reset input, 
R = Reset input LD := Load input, 
LD := Load input PV := Default value, 
PV := Default value QU => Status_up, 
QU := Status_up QD => Status_down, 
QD := Status_down CV => Count value); 
CV := Count value 


Count up 
input CU | | ia By is fi 


Count down 


input CD fl | | 
Reset input R 


Load input LD 


es 


Specified count 
value PV 


Current count 
value CV 


Counter 


status QU | a | 


Counter 


status QD (= es 


Fig. 12.36 Up/down counter CTUD, representation and function 
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If the current count value reaches the upper limit of the selected data type, it is no 
longer incremented. A positive edge at the count up input CU then has no effect. If 
the current count value reaches the lower limit of the selected data type, it is no lon- 
ger decremented. A positive edge at the count down input CD then has no effect. 


The current count value CV is set to the specified count value PV if the LD input has 
signal state “1”. Positive signal edges at the CU and CD counter inputs have no effect 
for as long as the LD input has signal state “1”. 


The count value is reset to zero if the reset input R has signal state “1”. Positive sig- 
nal edges at the CU and CD counter inputs and signal state “1” at the LD input have 
no effect for as long as the R input has signal state “1”. 


The QU output has signal state “1” if the current count value is greater than or equal 
to the specified count value (CV > PV). 


The Q output has signal state “1” if the current count value is less than or equal to 
zero (CV <0). 
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13 Digital functions 


13.1 General information 


This chapter describes the digital functions which mainly link digital tags together, 
for example the basic arithmetic operations for the arithmetic functions. As far as 
possible, the description is independent of the programming language. 


The digital functions are implemented internally - not visible to you as the user - 
either by means of simple statement sequences or by calling a system or standard 
block. Therefore you can find the digital functions in the statements catalog under 
Basic instructions and Extended instructions. 


The Chapters 7 “Ladder logic LAD” on page 283, 8 “Function block diagram FBD” on 
page 315, 9 “Statement list STL’ on page 348, and 10 “Structured Control Language 
SCL” on page 397 describe how you can program the functions using the individual 
programming languages and what special features exist. 


The following digital functions are available with a CPU 400: 


> The transfer functions transfer the value of a (digital) tag or memory area. 


> The comparison functions generate a binary result by comparing two tags. Tags 
with data types INT, DINT, REAL, STRING, and with time data types can be com- 
pared. 


> The arithmetic functions link two tags with data types INT, DINT, and REAL in 
accordance with the basic arithmetic operations. 


> The math functions convert the value of a tag with data type REAL in accordance 
with the specified function, for example calculation with a trigonometric func- 
tion. 


The conversion functions convert the data type of a tag. 
The shift functions shift the content of a tag bit by bit to the right or left. 


The logic functions comprise, for example, the word logic operations, which link 
two tags bit by bit, and the selection and limiting functions. 


The functions for strings process tags with data type STRING. Two strings can be 
combined, for example. 


The “simple” digital functions are boxes in the case of LAD and FBD (with LAD, the 
comparison is a contact), operations for linking the contents of accumulators in the 
case of STL, and arithmetic, logic and comparison expressions in the case of SCL. 
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13.2 Transfer functions 


The following are available for transfer of tag contents between memory areas: 


> “Simple” statements for copying a digital tag to another tag —- with the MOVE box 
in the case of LAD and FBD, with load and transfer functions in the case of STL, 
and with the value assignment function in the case of SCL 


> System blocks for transferring a memory area in the work memory 


> System blocks for controlling a memory area with MCR dependency 


13.2.1 General information on the “simple” transfer function 


The transfer function executed using “simple” statements copies the content of a 
data tag to another tag or transfers a fixed value to a digital tag. 


As aresult of the different language elements, the transfer function is represented 
differently in the various programming languages: by the MOVE box in the case of 
LAD and FBD, by load and transfer functions in the case of STL, and by the value 
assignment function in the case of SCL. 


13.2.2. MOVE box with LAD and FBD 


The MOVE box transfers the value at the IN parameter to the tag at the OUT1 param- 
eter (Fig. 13.1). You can use EN to control execution of the MOVE box depending on 
the result of logic operation. If EN = “1” or not connected, the transfer function is 
executed and ENO has signal state “1”. If EN = “0”, ENO is also = “0”. The MOVE box 
does not report any errors. 


LAD MOVE FBD MOVE Name | Declaration | Data type Description 
—EN ENO— —EN OUT1 —— EN - BOOL Enabling input 
—IN OUT1——- ~——IN ENO — ENO - BOOL Enabling output 

IN INPUT Data type *) | Input 
OUT1 OUTPUT Data type *) | First output 
*) See text 

Function: Data type: 

The value present in the IN parameter is All elementary data types (except BOOL). 

transferred to the OUT1 parameter. 

Dependencies: 

Execution of the MOVE box depends on the MCR function. 


Fig. 13.1 Representation and function of the MOVE box with LAD and FBD 
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Different data types 


Tags with different data types can be connected to the input and output of the MOVE 
box. Conversion of a data type is therefore possible. Table 13.1 shows the combina- 
tions with the block attribute IEC check deactivated. If IEC check is activated, the da- 
ta types at the input and output must be the same, with the following exceptions: 
With BYTE at the input, WORD and DWORD are permissible at the output; with 
WORD at the input, DWORD is permissible at the output. 


If the input tag is “smaller” than the output tag, it is transferred right-justified to 
the output tag and the space to the left is occupied by zero. Example: If input byte 
%IB4 is transferred to the memory word %MW48, zero is present in memory byte 
%MB48 and the value of input byte %IB4 is present in memory byte %MB49. 


If the input tag is “larger” than the output tag, only the right part of the input tag 
which fits in the output tag is transferred. Example: If memory word %MW50 is 
transferred to output byte %QB6, the value of memory byte %MB51 is present in 
output byte %QB6. 


Table 13.1 Different data types on the MOVE box with the IEC check block attribute 
deactivated 


IN parameter | OUT1 parameter 

BYTE BYTE, WORD, DWORD INT, DINT TIME, DATE, TOD CHAR 
WORD BYTE, WORD, DWORD INT, DINT TIME, DATE, TOD, SSTIME CHAR 
DWORD BYTE, WORD, DWORD INT, DINT, REAL TIME, DATE, TOD CHAR 
INT BYTE, WORD, DWORD INT, DINT TIME, DATE, TOD 

DINT BYTE, WORD, DWORD INT, DINT TIME, DATE, TOD 

REAL DWORD REAL 

TIME BYTE, WORD, DWORD INT, DINT TIME 

SSTIME WORD S5TIME 

DATE BYTE, WORD, DWORD INT, DINT DATE 

TOD BYTE, WORD, DWORD INT, DINT TOD 

CHAR BYTE, WORD, DWORD CHAR 


MCR dependency of the MOVE box 


The transfer to a memory area depends on the master control relay, and therefore 
the MOVE box only transfers the input value to the output tag if MCR dependency is 
switched off. Zero is transferred if MCR dependency is switched on. 


509 


13 Digital functions 


13.2.3 Loading and transferring with STL 


There are two statements with STL for the transfer of tag values that identify the 
transfer direction: The load statement is used to load a tag value from a memory 
area into accumulator 1. The transfer statement is used to transfer the value of 
accumulator 1 to a tag in a memory area: 


L  #Input_tag //Load into accumulator 1 

T #Output_tag //Transfer from accumulator 1 

The data types of the input and output tags are unimportant. The load statement 
can contain a constant or a digital tag with a width of up to 32 bits. The input tag is 


loaded right-justified into accumulator 1 and vacant bit positions are set to zero 
(Fig. 13.2). 


Loading and transferring 


Input tag for the loading function 
7 (n) Oy” (n+1) 07 (n+2) 07 (n+3) 0 Doubleword n 
7 (n) 0 7 (n+1) 0 Wordn 
¢ (n) 0 Byten 
31 24 23 Ve) 2S: aes 0 Accumulator 1 
a (n) 0 Byten 
i (n) 07 (n+1) 0 Wordn 
7 (n) 0 7 (n+1) 0 7 (n+2) | 7 (n+3) 0 Doubleword n 
Output tag for the transfer function 


Fig. 13.2 Transfer of tags with a width of 8, 16, or 32 bits 


The output tag for the transfer statement can be 8, 16, or 32 bits wide. The tag value 
is obtained right-justified from accumulator 1. The contents of accumulator 1 are 
not changed by this. 


The load and transfer statements are executed independent of the result of logic op- 
eration and the status bits. Neither the result of logic operation nor the status bits 
are influenced. 
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Influencing of accumulator 2 when loading 


The load function additionally changes the contents of accumulator 2. While the 
value of the input tag is being loaded into accumulator 1, accumulator 2 is simulta- 
neously assigned the old value of accumulator 1. The load function transfers the 
complete contents - independent of the size of the input tag - from accumulator 1 
to accumulator 2. In the case of a CPU 400, the previous contents of accumulator 2 
are lost in the process (see also Chapter 9.5.1 “Transfer functions” on page 367). 


Transferring only from accumulator 1 


You can use the transfer function just for accumulator 1. If you wish to transfer a 
value from accumulator 2, use the corresponding accumulator functions (TAK or 
POP) to transfer the contents of accumulator 2 into accumulator 1 and then transfer 
the value (see also Chapter 9.7.1 “Accumulator functions” on page 390). 


MCR dependency of transfer statement 


The transfer to a memory area depends on the master control relay and therefore 
the transfer statement only transfers the output parameter if MCR dependency is 
switched off. Zero is transferred if MCR dependency is switched on. 


13.2.4 Value assignments with SCL 


A value assignment transfers the value of an expression to a tag. On the left of the 
assignment operator is the output tag, which accepts the value of the expression 
positioned on the right. The expression can be a single tag, a combination of tag 
values, or a function whose value is assigned to the output parameter. 


#Output_tag := #Input_tag; //Assignment of tag value 


The data type of the value assignment is determined by the output tag. The data 
types on both sides of the assignment operator must be the same. Exception: With 
the IEC check block attribute deactivated, the “implicit data type conversion” is ap- 
plicable, see Chapter 13.6.1 “Implicit data type conversion” on page 531. 


Assignment for elementary data types 


A constant value, a different tag, or an expression can be assigned to a tag or 
operand. 


Absolutely addressed operands (e.g. %MW10) have one of the data types BOOL, 
BYTE, WORD, or DWORD. If you wish to assign a value with a different data type to 
an absolutely addressed operand, you can use the data type conversion or assign a 
name and the desired data type to the operand in the PLC tag table. 
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Assignment of DT and STRING tags 


Every DT tag can be assigned another DT tag or a DT constant. 


Every STRING tag can be assigned another STRING tag or a STRING constant. If the 
assigned string is longer than the tag present on the left of the assignment opera- 
tor, a warning is output during compilation. A STRING tag can be assigned a tag 
with data type CHAR. Example: 


#String := #Single_ character; 


Assignment of STRUCT tags or PLC data types 


A STRUCT tag or PLC data type can only be assigned to another STRUCT tag or PLC 
data type if 


> the data structures agree, 
> the data types of the structure components agree, and 


> the names of the structure components agree. 


Individual structure components can be handled like tags of the corresponding 
data type, for example a structure component #Motor1.Setpoint with data type INT 
can be assigned to another INT tag, or an INT value can be assigned to this structure 
component. 


Assignment of ARRAY tags 


An ARRAY tag can only be assigned to another ARRAY tag if the data types of the ar- 
ray components as well as the array limits with smallest and largest array index 
agree with each other. 


Individual array components can be handled like tags of the corresponding data 
type. With multi-dimensional arrays, you can handle the partial arrays like corre- 
spondingly dimensioned tags. 


Example: #Arrayl : ARRAY [1..8,1..16] OF INT represents a two-dimensional array; 
you can now address the complete array using #Array1, a partial array using #Ar- 
ray1[#i] (corresponds to the lines of the matrix), and an array component using 
#Array1[#i,#k]. 


The partial array #Array1/[#i] can be assigned to a correspondingly dimensioned 
array, e.g. #Array2 := #Array1[i], where i = 1 to 8, and #Array2 : ARRAY [1..16] OF 
INT. 


Aucwayil ARRAN [il 8, i. 516] Om aie Declaration 
Array2 ARRAY [1..16] OF INT 
var_int INT 


at INT 

k INT 

#var_int := #Arrayl[#i,#k]; Assignment of a component 
#Array2 := #Arrayl[#il; Assignment of a partial array 
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13.2.5 Copying and filling a data area in the work memory 

The following system blocks are available for copying and filling a data area: 
> BLKMOV Copy data area 

> UBLKMOV Copy data area without interruption 

> FILL Fill data area 


The representation is made with EN/ENO boxes in the case of LAD and FBD, and as 
a function call with error information as the function value in the case of STL and 
SCL. Fig. 13.3 shows the general graphic representation. 


Transfer functions with system blocks 


SFC 20 SFC 81 SFC 21 
Copy data area Copy data area without Fill data area 
interruption 
BLKMOV UBLKMOV FILL 
— SRCBLK RET VAL——- — SRCBLK RET_VAL— -— BVAL RET_VAL —— 
DSTBLK —— DSTBLK —— BLK —— 


Fig. 13.3 Graphic representation of the transfer functions 


Block parameters with data type ANY 


The system blocks BLKMOV, UBLKMOV, and FILL each have two parameters with 
data type ANY. You can basically connect any operand, any tag, or any absolutely 
addressed area to these parameters. 


If you use a tag with complex data type, it can only be a “complete” tag; components 
of a tag, e.g. individual array or structure components, are not permissible. You can 
use the ANY pointer for specifying an absolutely addressed area; its structure is de- 
scribed in Chapter 4.6.2 “Pointer” on page 135. With an ANY pointer of type BOOL, 
e.g. for an array with binary components, the number (the repetition factor) must 
be divisible by 8. With an ANY pointer of type STRING, the number must be 1. 


“Variable ANY pointer” 


If you connect an actual parameter with data type ANY, which is present in the tem- 
porary local data, to a block parameter of data type ANY, the program editor takes 
on the actual parameter as ANY pointer. In this manner you can set up an ANY 
pointer in the temporary local data which you can change during runtime, i.e. a 
variable (dynamic) design of the area is possible. Further details can be found in 
Chapters 4.6.3 ““Variable” ANY pointer with STL” on page 138 and 4.6.4 ““Variable” 
ANY pointer with SCL” on page 138. 
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Copying of STRING tags 


If a STRING tag is only present at the SRCBLK parameter, the current characters of 
the tag are copied. The two bytes with the length data are not written into the des- 
tination area. 


If tags with data type STRING are present at both the SRCBLK and DSTBLK parame- 
ters, the two length bytes are also transferred to the destination tag. 


BLKMOV Copy data area 


BLKMOV copies the contents of a source area at the SRCBLK parameter in the direc- 
tion of increasing addresses (incrementing) into a destination area at the DSTBLK 
parameter. With BLKMOV, the copying process can be interrupted by a program of 
higher priority following each doubleword. 


The following actual parameters can be connected to the SRCBLK and DSTBLK 
parameters: 


> Any tags from the data blocks in the work memory and from the following oper- 
and areas: inputs I, outputs Q, bit memories M 


> Tags from the temporary local data (with special handling for data type ANY) 
> Absolutely addressed data areas with specification of an ANY pointer 


> Tags from data blocks that are only in the load memory (only as input value at 
parameter SRCBLK). 


You cannot use BLKMOV to access the peripheral inputs and outputs and the 
SIMATIC timers and counters operand areas. 


Using BLKMOV, a CPU 400 can read a tag or memory area from a data block with the 
attribute Only store in load memory. When reading from the load memory, the 
transfer must not be interrupted by a higher-priority program. 


The specified area is copied in the case of inputs and outputs independent of the 
actual assignment with input and output modules. 


The source and destination areas must not overlap. If the source and destination ar- 
eas are of different length, transfer is only performed up to the length of the small- 
er area. No data transfer takes place if the limits of operand areas are violated and 
an error message is output. 


UBLKMOV Copy data area without interruption 


UBLKMOV copies the contents of a source area at the SRCBLK parameter in the 
direction of increasing addresses (incrementing) into a destination area at the 
DSTBLK parameter. With UBLKMOV, copying cannot be interrupted and therefore 
the time required for responding to interrupts may increase under certain circum- 
stances. The maximum number of transmitted bytes is therefore limited to 512. 
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The following actual parameters can be connected to the SRCBLK and DSTBLK 
parameters: 


> Any tags from the data blocks in the work memory and from the following oper- 
and areas: inputs I, outputs Q, bit memories M 


> Tags from the temporary local data (with special handling for data type ANY) 


> Absolutely addressed data areas with specification of an ANY pointer 


You cannot use UBLKMOV to access the peripheral inputs and outputs, data blocks 
in the load memory, or the SIMATIC timers and counters operand areas. 


The specified area is copied in the case of inputs and outputs independent of the 
actual assignment with input and output modules. 


The source and destination areas must not overlap. If the source and destination ar- 
eas are of different length, transfer is only performed up to the length of the small- 
er area. No data transfer takes place if the limits of operand areas are violated and 
an error message is output. 


FILL Fill data area 


FILL copies a defined value (source area) into a memory area (destination area) as 
often as necessary until the latter is written completely. The transfer is carried out 
in the direction of increasing addresses (incrementing). 


The following actual parameters can be connected to the BVAL and BLK parameters: 


> Any tag from the data blocks in the work memory and from the following oper- 
and areas: inputs I, outputs Q, bit memories M 


> Absolutely addressed data areas with specification of an ANY pointer 


> Tag in the temporary local data of data type ANY (special handling) 


You cannot use FILL to access the peripheral inputs and outputs, data blocks in the 
load memory, or the SIMATIC timers and counters operand areas. 


The specified area is filled in the case of inputs and outputs independent of the ac- 
tual assignment with input and output modules. 


The source and destination areas must not overlap. The destination area is always 
written completely, even if the source area is larger than the destination area or if 
the length of the destination area is not an integral multiple of the length of the 
source area. No data transfer takes place if the limits of operand areas are violated 
and an error message is output. 


13.2.6 Control memory area with MCR dependency 


The following system and standard blocks are available for setting and resetting a 
memory area with MCR dependency switched on: 


> SETP Set I/O area bit by bit 
> RESETP Reset I/O area bit by bit 
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> SET Set process image and memory area bit by bit 
> RESET Reset process image and memory area bit by bit 
> SETI Set process image and memory area byte by byte 


> RESETI Reset process image and memory area byte by byte 


The representation is made with EN/ENO boxes in the case of LAD and FBD, and as 
a function call with or without function value in the case of STL. The function of the 
master control relay is not implemented with SCL. 


Fig. 13.4 shows the general graphic representation of these functions. 


Control memory areas with MCR dependency 


SFC 79 SFC 80 
Set peripheral Reset peripheral 
outputs bit by bit outputs bit by bit 
Call in an MCR zone, 
fee BEGENS only effective with MCR 
—N RET VAL — —N RET VAL — dependency activated. 
SA — SA — 
FC 83 FC 82 
Set process image and Reset process image and 
bit memory bit by bit bit memory bit by bit 
Call in an MCR zone, 
a) RSA only effective with MCR 
—Ieapin — een dependency activated. 
—N —N 
FC 101 FC 100 
Set peripheral Reset peripheral 
outputs byte by byte outputs byte by byte 
Call in an MCR zone, 
an ESSER only effective with MCR 
— 5 BYTE — 5S BYTE dependency activated. 
—_ —N 


Fig. 13.4 Graphic representation of the set and reset functions with MCR dependency 


SETP Set peripheral output area bit by bit 
RESETP Reset peripheral output area bit by bit 


SETP sets the bits in a continuous area of the peripheral outputs to signal state “1”. 


RESETP resets the bits in a continuous area of the peripheral outputs to signal 
state “O”. 


You call SETP and RESETP in an MCR zone. The system blocks only work with 
MCR dependency switched on; if MCR dependency is switched off, calling of SETP or 
RESETP has no effect. 
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Setting and resetting of the I/O bits results in simultaneous updating of the process 
image outputs. The I/O is influenced byte by byte. The bits in the first and last bytes 
which have not been selected by the system blocks are assigned the signal states 
currently present in the process image output. 


You use the N parameter to define the number of bits to be controlled and the SA 
parameter to define the first bit (data type POINTER). RET_VAL is used by the system 
blocks to signal any errors. 


SET Set process image and bit memory address area bit by bit 
RESET Reset process image and bit memory address area bit by bit 


SET sets the bits in a continuous memory area or in the process image inputs and 
outputs to signal state “1”. 


RESET resets the bits in a continuous memory area or in the process image inputs 
and outputs to signal state “0”. 


You call SET and RESET in an MCR zone. The system blocks only work with the MCR 
dependency switched on; if the MCR dependency is switched off, calling of SET or 
RESET has no effect. 


The bits in the first and last bytes which have not been selected by the system blocks 
retain the current signal states. 


You use the N parameter to define the number of bits to be controlled and the S_BIT 
parameter to define the first bit (data type POINTER with cross-area, 
register-indirect addressing). If the S BIT parameter does not point to the memory 
area or process image, the bits are not influenced and the ENO output has signal 
state “O”. 


SETI Set peripheral output bits byte by byte 
RESETI Reset peripheral output bits byte by byte 


SETI sets the bits in a continuous area of the peripheral outputs to signal state “1”. 


RESETI resets the bits in a continuous area of the peripheral outputs to signal 
state “0”. 


You call SETI and RESETI in an MCR zone. The system blocks only work with the MCR 
dependency switched on; if the MCR dependency is switched off, calling of SETI or 
RESETI has no effect. 


You use the N parameter to define the number of bits to be controlled, which must 
be a multiple of eight. You use the S BYTE parameter to define the first byte (data 
type POINTER with cross-area, register-indirect addressing and bit address = 0). If 
the S BYTE parameter does not point to the peripheral output area, if the bit ad- 
dress is not zero, and if the number N is not a multiple of eight, the bits are not in- 
fluenced and the ENO output has signal state “0”. 


The corresponding bits are not updated in the process image output. 
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13.3. Comparison functions 


The following are available for comparing two tags: 


> The comparison function implemented using “basic instructions” for comparing 
numerical values 


> The comparison function implemented using system blocks for comparing two 
tags with data types DT (T_COMP) and STRING (S_COMP) 


The “simple” comparison functions are the comparison contact in the case of LAD, 
the comparison box in the case of FBD, the comparison operation in the case of STL, 
and the comparison expression in the case of SCL. 


13.3.1 Execution of “simple” comparison function 


A comparison function compares the values of two digital tags and delivers the 
binary comparison result “1” or TRUE in the case of “comparison fulfilled” or “O” or 
FALSE in the case of “comparison not fulfilled”. Table 13.2 shows setting of the com- 
parison result depending on the magnitude of the compared values. 


Table 13.2 Result following a comparison function 


The relation between the compared values delivers the following comparison result with 
== <> > Ss < <= 
Input value 1 > Input value 2 (Accu 2 > Accu 1) 0" pile wll Fi AOs 40” 
Input value 1 = Input value 2 (Accu 2 = Accu 1) a” 10" 10" a 10" il 
Input value 1 < Input value 2 (Accu 2 < Accu 1) 0" gl 0" 0" Pale il” 


Fig. 13.5 shows how the comparison function is implemented in the various pro- 
gramming languages. 


With LAD and FBD, the two digital tags to be compared must have the data type set 
for the comparison function. 


With STL, the comparison is carried out according to the data type defined by the 
comparison operation. The user must make sure that the “correct” data type is 
present in the accumulators. Comparisons according to INT only compare the right 
word of the accumulators, comparisons according to DINT and REAL compare the 
complete contents. 


With SCL, the comparison is implemented by a comparison expression. The com- 
pared tags must belong to the same class of data type, i.e. BYTE, WORD, and DWORD 
can be compared with each other, as can INT, DINT, and REAL. 


A prerequisite for a fulfilled comparison with floating-point numbers is that they 
are valid. If an invalid floating-point number is compared, the comparison is never 
fulfilled. The comparison function is carried out independent of conditions. Table 
13.3 shows how a comparison function influences the status bits. 
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"Simple" comparison function 


LAD IN] FBD Function Name] Declaration] Data type | Description 
Function Data type IN1 INPUT Data type *)| Input tag 1 
= Data type = __ ine IN2_ | INPUT Data type *)| Input tag 2 
IN2 — INQ bs te OUTPUT BOOL Result of comparison 


*) The two data types must be the same 
The comparison function compares the contents of two tags IN1 and IN2 according to the 
following scheme: 
Result := IN1 <Comparison> IN2. 


Function: Data types: 
== equal to INT, DINT, REAL, TIME, BYTE, WORD, DWORD 
<> not equal to INT, DINT, REAL, TIME, BYTE, WORD, DWORD 
> greater than INT, DINT, REAL, TIME 
< less than INT, DINT, REAL, TIME 
>= greater than or equal to INT, DINT, REAL, TIME 
<= less than or equal to INT, DINT, REAL, TIME 
STL : 
eee eel The contents of accumulator 2 (IN1) are compared with the 
LENZ contents of accumulator 1 (IN2) and the result of the 
Comparison opera tion comparison assigned to the RLO: 
= Result of comparison Result of comparison = IN1 Comparison operation IN2 
The comparison operation does not change the contents of 
the accumulators. 
The comparison operation sets the status bits. 
Comparison operation: 
==1,) -==) J ==h equal to The comparison operation interprets the 
<I, <>D, <R not equal to contents of the accumulators in 
>I, SD SB greater than accordance with the data type during the 
eat <D, <R less than operation: 
>=], >=D, >=R greater than or equal to I= INT, D = DINT, R= REAL. 
<=I, <=D, <=R less than or equal to 
SCL Result of comparison := IN1 Comparison function IN2; 
Comparison function: Approved data types: 
== equal to Comparison of: Comparison with: 
<> not mila to INT, DINT, REAL INT, DINT, REAL 
> greater than ny 
a eaainera CHAR, STRING CHAR, STRING *) 
>= greater thanorequalto TIME TIME 
<= less than or equal to DATE DATE 
TIME_OF_DAY TIME_OF_DAY 


In addition with equal to and not equal to: 

BYTE, WORD, DWORD BYTE, WORD, DWORD 

*) With a comparison CHAR and STRING, only one character of 
the string can be compared: 

#result := #var_char <= #var_string[#i]; 


Fig. 13.5 Function and representation of “simple” comparison functions 
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Table 13.3 Status bits with a comparison function 


Status bit BR cci | cco Ov os OR STA | RLO | /FC 
The result is equal to - 0) 0) 0) - 0 x x 1 
greater than = 1 0 0 = 0 x x q 
less than = 0 1 0 = 0 x x 1 
Invalid REAL number - 1 1 1 1 0 x x 1 
The comparison is fulfilled - x x (0) - (0) 1 1 1 
not fulfilled - x x 0 - 0 0 0 | 


13.3.2. Comparison function T_COMP 


T_COMP compares two tags with data type DATE_AND_TIME (DT). The graphic rep- 
resentation is shown in Fig. 13.6. The comparison function T_COMP is implement- 
ed with loadable standard functions (FC), which are represented as an EN/ENO box 
in LAD and FBD and as a block call in STL and SCL with the comparison result as a 
function value. 


Comparison function for tags of data type DT 


The comparison function T.COMP compares two tags of data type DATE_AND_TIME (DT). 
T_COMP is implemented using loadable standard functions (FC). 


Compare tag of Comparison function: 


data type DT : 
oP Comparison for Block 

T_COMP EQ equal to FC9 EQ_DT 
Comparison function NE not equal to FC28 NE_DT 
GT greater than FC14 GT_DT 
DYAIE_ZANID)_INMIE GE greater than or equal to] FC 12 GE_DT 
— = LT less than FC 23 LT_DT 
UNL EWA LE _ less than or equal to FC18 LE_DT 

— IN2 OUT — 


Fig. 13.6 Representation of comparison function for time data types 


A time is considered as “greater than” if it is later, in other words closer to the pres- 
ent time or further in the future than the comparison value. 


The function value is TRUE if the comparison is fulfilled, otherwise FALSE. A tag 
with data type DT is considered as “less than” if the time is older. 


T_COMP does not signal an error. 
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13.3.3. Comparison function S_ COMP 


S_COMP compares two tags with data type STRING. The graphic representation is 
shown in Fig. 13.7. The comparison function S_COMP is implemented with loadable 
standard functions (FC), which are represented as an EN/ENO box in LAD and FBD and 
as a block call in STL and SCL with the comparison result as a function value. 


Comparison function for tags of data type STRING 


The comparison function S_COMP compares two tags of the data type STRING. 
S_COMP is implemented using loadable standard functions (FC). 


enue be ae Comparison function: 

neal pe SERN Comparison for Block 
S_COMP EQ equal to FC10 EQ_STRNG 
Comparison function NE not equal to FC 29 NE_STRNG 
STRING GT greater than FC15 GT_STRNG 
GE greater than or equal to | FC 13. GE_STRNG 
__| | LT less than FC 24 LT_STRNG 
IM IEVT_AWANL LE _ less than or equal to FC19 LE_STRNG 

— IN2 OUT 


Fig. 13.7 Representation of comparison function for strings 


Starting from the left, the characters of the tags are compared by their ASCII code 
(for example, ‘a’ is greater than 'A’). The first character to be different decides the re- 
sult of the comparison. Two strings are the same if the relevant (occupied) charac- 
ters are the same and the current length is the same. A string is considered as 
“greater than” if it is longer when the first characters are identical. The maximum 
lengths of the strings are not included in the comparison. 


The function value is TRUE if the comparison is fulfilled, otherwise FALSE. 


S_COMP does not signal an error. 


13.4 Arithmetic functions 


Two types of arithmetic functions are available: 


> Arithmetic functions implemented using “basic instructions” for basic arithme- 
tic operations in association with numbers of data types INT, DINT, and REAL 


> Arithmetic functions for date and time implemented using system blocks 
(T_ADD, T_SUB, T_DIFF, T COMBINE) 


With SCL, the arithmetic functions implemented with system blocks are included in 
the arithmetic expression. 
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Arithmetic functions 


LAD FBD 


Function Function Name | Declaration | Data type Description 
Data type Data type EN - BOOL Enabling input 
— EN ENO —- ——EN ENO - BOOL Enabling output 
—i OUT —— —IN1 OUT — ‘\n1 INPUT Data type *) | Input tag 1 
— IN2 — IN2 ENO — _ \n2 INPUT Data type *) | Input tag 2 
OUT OUTPUT Data type *) | Result 


*) All parameters of the same data type 


An arithmetic function links the contents of two tags IN1 and IN2 according to the following 
scheme: Result := IN1 <operation> IN2. 


Function: Data types: 
ADD Addition INT, DINT, REAL 
SUB Subtraction INT, DINT, REAL 
MUL Multiplication INT, DINT, REAL 
DIV Division INT, DINT, REAL 
MOD _ Division with remainder as result DINT 

STL [iene 


The contents of accumulator 2 (IN1) are linked with the contents of 


= Ne ; ’ accumulator 1 (IN2) and the result stored in accumulator 1. 
ce aged operation ‘The contents of accumulator 2 remain unchanged. 


Arithmetic operation: 


+I, +D, +R Addition The arithmetic operation interprets 
at, ab, JR Subtraction the contents of the accumulators in 
a, 1D), oR Multiplication accordance with the data type 
f, iD, IR Division during the operation: 
MOD Division with remainder I = INT, D = DINT, R = REAL. 

as result 


With a calculation with data type INT, only the right words of the 
accumulators are influenced; the contents of the left words remain 
unchanged. An arithmetic function influences the status bits. 


SCL OUT := IN1 Function IN2; 
Function: Approved data types: 
+ Addition Operand 1: Operand 2: Result 
= Subtraction With addition and subtraction: 
i Multiplication INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL *) 
! Division TIME TIME TIME 
MOD _ Division with TOD TIME TOD 
remainder as DT TIME DT 
meen Additionally with subtraction: 
DATE DATE TIME 
TOD TOD TIME 
DT DT TIME 
With multiplication and division: 
INT, DINT, REAL INT, DINT, REAL INT, DINT, REAL *) 
TIME INT, DINT TIME 
With division with remainder as result: 
INT, DINT INT, DINT INT, DINT *) 


*) The result assumes the "more significant" data type: 
REAL before DINT before INT. 


Fig. 13.8 Description of arithmetic functions for numerical values 
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13.4.1 General function description 


A “simple” arithmetic function links two digital values in accordance with the basic 
arithmetic operations. These are two digital tags which are linked in the case of 
LAD, FBD, and STL; expressions are also possible in the case of SCL. The result of an 
arithmetic function is transferred with LAD and FBD to a digital tag, it is present in 
accumulator 1 with STL, and with SCL the result can be assigned to a digital tag or 
linked further. 


Fig. 13.8 shows the general representation of an arithmetic function in the various 
programming languages. 


13.4.2 Data types and status bits for an arithmetic function 


Operand width, data types 


The tags involved in the calculation must be of the same data type unless implicit 
data type conversion is involved (see Chapter 13.6.1 “Implicit data type conversion” 
on page 531). 


Calculating with data type REAL 


REAL numbers are mapped internally as floating-point numbers with two numeri- 
cal ranges: one range with full accuracy (“normalized” floating-point numbers) and 
one range with limited accuracy (“denormalized” floating-point numbers, see also 
Chapter 4.4.5 “Floating-point data type REAL” on page 124). A CPU 400 calculates in 
both ranges, a CPU 300 only in the range with full accuracy. If the result of a calcu- 
lation with a CPU 300 falls in the range with limited accuracy, zero is output as 
result and a downward violation of the numerical range is signaled. 


Table 13.4 Status bits with an arithmetic function for fixed-point calculation 


Status bits with INT DINT cco | Cc1 OV os 

The result is <—32 768 (+1, -l) <-2 147 483 648 (+D, —-D) 0 1 1 1 
<-32 768 (*l) <-2 147 483 648 (*D) 1 0 1 1 
—32 768 to -1 —2 147 483 649 to -1 1 0 0 - 
0 0 0 0 0 = 
+1 to +32 767 +1 to +2 147 483 647 0 1 0) = 
>+32 767 (+1, -l) >+2 147 483 647 (+D, -D) l 0 1 1 
>+32 767 (*l) >+2 147 483 647 (*D) 0 ‘| 1 
+32 768 (Il) +2 147 483 648 (/D) 0 1 1 
(-)65 536 (-)4 294 968 296 (e) 0 1 1 

Division by zero (/l) (/D, MOD) 1 1 1 


523 


13 Digital functions 


Setting of status bits 


An arithmetic function sets all digital condition codes. CCO and CC1 signal whether 
the result is negative, zero, or positive. Anumerical range overflow sets OV and OS 
(note the different significance of CCO and CC1 in the case of an overflow). A divi- 
sion by zero is indicated by “1” in all digital condition codes (Table 13.4). 


The result of an arithmetic function with data type REAL is in the permissible 
numerical range if it is “normalized”. A invalid REAL number is indicated by “1” in 
all digital condition codes (Table 13.5). 


Table 13.5 Status bits with an arithmetic function for floating-point calculation 


Status bits with REAL cco | Cc1 Ov os 

The result is + normalized 0 1 0 - 
+ denormalized 0 0 1 1 
+ zero 0 ie) ie) 7 
— normalized 1 0 0 - 
+ infinite (division by zero) 0 1 1 ‘| 
— infinite (division by zero) 1 0 1 1 
+ invalid REAL number 1 1 1 1 


If an error occurs during execution of the arithmetic function, the binary result BR 
and the ENO output are set to signal state “O” in the case of LAD and FBD, and the 
ENO tag and the ENO output to FALSE in the case of SCL. 


Master control relay (MCR) dependency 


The (actual) arithmetic function which links the contents of the two accumulators 
is independent of the MCR function. Saving of the result of a calculation with an 
EN/ENO box (LAD, FBD) or with a transfer statement (STL) only takes place with the 
MCR functionality switched off. Zero is saved if the MCR function is switched on. 


13.4.3 Execution of the arithmetic function 


Addition ADD 


ADD adds the two input tags IN1 and IN2 and saves the total in the result OUT. An 
error occurs if the permissible numerical range is left, if one of the input tags is an 
invalid floating-point number, or if an attempt is made to add the floating-point 
numbers +0 and -oo. 
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Subtraction SUB 


SUB subtracts the input tag IN2 from the input tag IN1 and saves the difference in 
the result OUT. An error occurs if the permissible numerical range is left, if one of 
the input tags is an invalid floating-point number, or if an attempt is made to sub- 
tract the floating-point numbers +o from +0 or -« from -oo. 


Multiplication MUL 


MUL multiplies the two input tags IN1 and IN2 and saves the product in the result 
OUT. An error occurs if the permissible numerical range is left, if one of the input 
tags is an invalid floating-point number, or if an attempt is made to multiply the 
floating-point numbers o and 0. 


Division DIV with fixed-point numbers 


DIV divides the input tag IN1 (dividend) by the input tag IN2 (divisor) and delivers 
the quotient in the result OUT. The quotient is the integer result of the division. The 
quotient is zero if the dividend is equal to zero and the divisor not equal to zero, or 
if the magnitude of the dividend is smaller than the magnitude of the divisor. The 
quotient is negative if the divisor is negative. A division by zero delivers a value of 
zero as the quotient and signals an error. 


Division DIV with floating-point numbers 


DIV divides the input tag IN1 (dividend) by the input tag IN2 (divisor) and delivers 
the quotient in the result OUT. An error occurs if one of the input tags is an invalid 
floating-point number or if an attempt is made to divide the floating-point num- 
bers oo by » or 0 by 0. 


Division MOD with remainder as result 


MOD divides the input tag IN1 (dividend) by the input tag IN2 (divisor) and delivers 
the remainder of the division in the result OUT. The remainder is the leftover part of 
the division; this is not the decimal places. With a negative dividend, the remainder is 
also negative. A division by zero delivers a value of zero as the remainder and sig- 
nals an error. 


13.4.4 Arithmetic functions for date and time 


The arithmetic functions for date and time link tags with data types TIME, TOD, 
DATE, and DT. Fig. 13.9 shows the graphic representation of these functions. The 
date/timer functions are loadable standard functions (FC) which are represented as 
EN/ENO boxes in LAD and FBD and as block call with function value in STL and SCL. 


If the result of the arithmetic function is not within the permissible range, the re- 
sult is limited to the corresponding value. The binary result BR and the ENO output 
are then set to “0” in the case of LAD and FBD, and the ENO tag and ENO output to 
FALSE in the case of SCL. 
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Arithmetic functions for date and time 


Arithmetic functions Function: 
for date and time 
Function Block 
munedon T_ADD FC1 AD_DT_TM 
Data type T_SUB FC 35 SB_DT_TM 
T_DIFF FC 34 SB_DT_ST 
— IN OUT —— T_COMBINE | FC3 D_TOD_DT 
— IN2 
Data types: 
Function description IN1 IN2 OUT 
T_ADD adds a duration to a point in time DT + TIME = ODT 
T_SUB subtracts a duration from a point in time DT — TIME = DT 
T_DIFF generates the difference between two points in time DT -— ODT = TIME 
T_COMBINE combines the date and time into a point in time DATE + TOD = ODT 


Fig. 13.9 Graphic representation of the arithmetic functions for date and time 


Some date/timer functions set the binary result BR and the ENO output to “0” if an 
error has occurred during processing of the function. 


T_ADD Add duration to a time 


T_ADD adds a duration in TIME format to a time in DATE_AND_TIME format and 
delivers a new time in DATE_AND_TIME format as the result. The result must be in 
the range from DT#1990-01-01-00:00:00.000 to DT#2089-12-31-59:59:59.999. 


T_SUB Subtract duration from a time 


T_SUB subtracts a duration in TIME format from a time in DATE_AND_TIME format 
and delivers anew time in DATE_AND_TIME format as the result. The result must be 
in the range from DT#1990-01-01-00:00:00.000 to DT#2089-12-31-59:59:59.999. 


T_DIFF Subtract two time values 


T_DIFF subtracts two times in DATE_AND_TIME format and delivers a duration in 
TIME format as the result. The times must be in the range from 
DT#1990-01-01-00:00:00.000 to DT#2089-12-31-59:59:59.999. 


If the first time IN1 is greater (more recent) than the second time IN2, the result is 
positive; if the first time is smaller (less recent) than the second time, the result is 
negative. 


T_COMBINE Combine DATE and TIME _OF_DAY to DT 


T_COMBINE combines the DATE and TIME _OF_DAY formats and converts these for- 
mats into the DATE _AND_TIME format. The input value IN1 must be between the 
limits DATE#1990-01-01 and DATE#2089-12-31. 


T_COMBINE does not signal errors. 
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13.5 Math functions 


13.5.1 General function description 


A mathematical function converts the value of a tag present at the input in accor- 
dance with the function, and writes it into the tag present at the output. Fig. 13.10 
shows the general representation of a math function in the various programming 
languages. 


“Math functions” include the following: 
> Sign, cosine, tangent 

> Arcsine, arccosine, arctangent 

> Generate square, extract square root 


> Exponential function to base e, natural logarithm 


13.5.2 General execution of a math function 


All math functions process numbers in data format REAL. With SCL, the input 
parameters can also be of data type INT or DINT; the result is always delivered with 
data type REAL. 


Setting of status bits 


A math function sets all digital condition codes (Table 13.6). 
An error occurs if the permissible numerical range is left or if the input tag is an in- 
valid floating-point number. The binary result BR and the ENO output are then set 


to “O” in the case of LAD and FBD, and the ENO tag and ENO output to FALSE in the 
case of SCL. 


Table 13.6 Status bits with a math function 


Status bits with REAL cco | CCc1 Ov os 

The result is + normalized 0 1 0 - 
+ denormalized 0 0 1 1 
+ zero 0 0 0 = 
— normalized 1 0 0 - 
+ infinite (division by zero) 0 1 1 1 
— infinite (division by zero) 1 0 1 1 
+ invalid REAL number 1 1 1 1 
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Mathematical functions 


LAD Function FBD | Function Name | Declaration | Data type Description 
Data type Data type EN - BOOL Enabling input 
— EN ENO—- —EN OUT— Eno |- BOOL Enabling output 
— IN OUT —- — IN ENO — In INPUT REAL Digital tag 
OUT OUTPUT REAL Result 
Function: SIN Sine ASIN Arcsine 
cos Cosine ACOS __ Arccosine 
TAN Tangent ATAN Arc tangent 
SQR Generate square EXP Exponential function to base e 
SQRT Extract square root LN Natural logarithm 
The value present in the IN parameter is calculated according to the mathematical function, 
and output in the OUT parameter. 

STL 1 IN The value in accumulator 1 is calculated according to the 
Mathematical operation mathematical operation, and the result stored in accumulator 1. 
rT OUr The contents of accumulator 2 remain unchanged. 

A mathematical operation influences the status bits. 
Operation: SIN Sine ASIN Arcsine 
cos Cosine ACOS = Arccosine 
TAN Tangent ATAN Arc tangent 
SQR Generate square EXP Exponential function to base e 
SQRT Extract square root LN Natural logarithm 
SCL OUT := Function (IN); 
Function: SIN Sine ASIN Arcsine 
cos Cosine ACOS = Arccosine 
TAN Tangent ATAN Arc tangent 
SQR Generate square EXP Exponential function to base e 
SQRT Extract square root LN Natural logarithm 
10** Exponential function to base 10 
LOG Common logarithm 
Data type: 
INT, DINT, and REAL are permitted as data types for the input tag. The result is present in the 
data type REAL. 


Fig. 13.10 Overview of math functions 


Master control relay (MCR) dependency 


The (actual) math function which changes the content of accumulator 1 is indepen- 
dent of the MCR function. Saving of the result of a calculation with an EN/ENO box 
(LAD, FBD) or with a transfer statement (STL) only takes place with the MCR func- 
tionality switched off. Zero is saved if the MCR function is switched on. 


13.5.3 Trigonometric functions SIN, COS, TAN 


The trigonometric functions generate the sine (SIN), cosine (COS), or tangent (TAN) 
of the input tag IN and deliver this in the result OUT. An angle in radians is expected 
at the input tag IN. 
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Two units are commonly used for the magnitude of an angle, degrees from 0° to 
360° (360th part of the circumference of a circle) and radians from 0 to 2m (where 
M1 =+3.141593e+00). Both units can be converted proportionately. For example, the 
value in radians for a 90° angle is n/2, in other words +1.570796e+00. With values 
larger than 2n (+6.283185e+00), 2m or a multiple thereof is subtracted until the 
input value for the trigonometric function is less than 2n. 


An error occurs if the input tag IN is an invalid floating-point number, +o or -o0. The 
value of IN is then output in the result OUT. 


13.5.4 Arc functions ASIN, ACOS, ATAN 


The arc functions (inverse trigonometric functions) generate the arcsine (ASIN), 
arccosine (ACOS), or arctangent (ATAN) of the input tag IN and output this in the re- 
sult OUT. The arc functions are the inverse functions of the respective trigonomet- 
ric function. They expect a number within a specific value range at the input tag IN 
and output an angle in radians (Table 13.7). 


Table 13.7 Range of values of the arc functions 


Function Permissible range of values Returned value 
Arcsine ASIN -1to+1 —m/2 to +1/2 
Arccosine ACOS -1to+1 Oton 
Arctangent ATAN Complete range —m/2 to +1/2 


An error occurs if the input tag IN is not in the range +1 (with ASIN or ACOS) or is 
an invalid floating-point number. An invalid floating-point number is then output 
in the result OUT. 


13.5.5 Additional math functions 

The following additional math functions are available: 
SQR Generate square 

SQRT Extract square root 

EXP Generate exponential function to base e 


LN Generate natural logarithm (logarithm to base e) 


Generate square SQR 
SQR generates the square of the input tag IN and outputs it in the result OUT. 


OUT = IN” 
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An error occurs if the input tag IN or the result is an invalid floating-point number. 
An invalid floating-point number is output in the result OUT in the first case and +00 
in the second case. 


Extract square root SQRT 
SQRT generates the square root of the input tag IN and outputs it in the result OUT. 
OUT = JIN 


An error occurs if the input tag IN is negative, an invalid floating-point number, 
or +o. An invalid floating-point number or + is then output in the result OUT. 


Exponentiation to base e EXP 


EXP generates the exponential from base e (= 2.718282e+00) and the input tag IN 
and outputs it in the result OUT. 


out = ¢'% 


An error occurs if the input tag IN or the result is an invalid floating-point number. 
An invalid floating-point number is output in the result OUT in the first case and +00 
in the second case. 


Generate natural logarithm LN 


LN calculates the natural logarithm to base e (= 2.718282e+00) from the input tag 
IN and outputs it in the result OUT. 


OUT = In(IN) 
An error occurs if: 


> The input tag IN1 is zero, negative, -oo, or a negative invalid floating-point num- 
ber. -o is then output in the result OUT. 


> The input tag IN1 is +o or a positive invalid floating-point number. The value of 
IN1 is then output in the result OUT. 


The natural logarithm is the inverse function of the exponential function: if y = e*, 
then x =Iny. 
If you wish to calculate any logarithm, use the equation 


log,a 
log,b 


logpa = 
where b or n is any base. If you set n = e, you can use the natural logarithm to cal- 
culate a logarithm to any base: 


log,a = ig 
"Ind 


In the special case for base 10, the equation is: 


Iga= 84 = 0.4342945-Ina 
In10 
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13.6 Conversion functions 


If you link tags together, they must have the same data type. This also applies if you 
assign values or supply function and block parameters. If a tag is not available in 
the required data type, the data type must be converted. The conversion functions 
are available for this. 


The following conversion functions are available: 


Conversion of fixed-point numbers 
Conversion of floating-point numbers 
Generation of absolute value and negation 


Conversion of time data types (T_CONV) and character data types (S_CONV) 
implemented using system blocks 


Conversion of hexadecimal numbers (ATH, HTA) as well as scaling and unscaling 
(SCALE, UNSCALE) implemented using system blocks 


These conversion functions are “explicit” conversion functions where the bit as- 
signments of the tags change or where conversion errors can occur, for example a 
conversion from DINT to REAL. These conversions must be programmed. 


13.6.1 Implicit data type conversion 


“Implicit” conversion functions also exist which convert a data type without chang- 
ing the bit assignments and do not signal an error, for example the conversion from 
BYTE to WORD. These conversions are carried out “automatically”. 


Implicit data type conversion is not possible in the programming language STL. 
STL interprets the contents of accumulators according to the executed operation 
and independent of the significance of the bit assignments, i.e. independent of the 
(actual) data type. For example, the +I operation (integer addition) interprets the 
contents of the accumulators as numbers with data format INT and adds them to- 
gether according to the integer rules. The programmer is responsible for ensuring 
that numbers with data format INT are actually present in the accumulators during 
execution of the operation. 


It always applies during implicit data type conversion that the bit length of the 
source data type must not exceed that of the destination data type. For example, a 
tag with data format DWORD (source data type) cannot be applied to a block 
parameter which expects data type WORD (destination data type). 


The scope of implicit data type conversion depends on the block attribute IEC check 
(see Table 13.8). 


To improve clarity, implicit data type conversion can also be programmed with 
SCL. The statement is Source data type_TO_Destination data type, for example 
#var_word := BYTE_TO_WORD(#var_byte); 
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Table 13.8 Implicit data type conversion 


FO allie tlliteee & =| a | « 5 is Z 
om JE (ete le eel e eS 3 22 elle 
BOOL XS XS XS 
BYTE X X oO 
WORD X oO 
DWORD O 
INT XS XS 
DINT XS oO OS 
REAL 
TIME oO O 
S5TIME oO 
DT 
TOD 
DATE 
CHAR O OS OS XS 
Implicit data type conversion is possible: X Independent of attribute [EC check 

O With deactivated attribute IEC check 
XS__ Additionally with SCL and independent of attribute IEC check 
OS Additionally with SCL and deactivated attribute [EC check 


13.6.2 Data type conversion of fixed-point numbers 


The conversion function CONV converts the data types of fixed-point numbers. Fig. 
13.11 shows the general representation of the conversion function in the various 
programming languages. CONV is represented as an EN/ENO box in the case of LAD 
and FBD, as operations in the case of STL which convert the value in accumulator 1, 
and in the case of SCL there are functions with the notation Source data 
type_TO_Destination data type. 


The conversion options additionally offered by SCL are described in Chapter 10.5.5 
“Conversion functions” on page 413. 


Setting of status bits and of the ENO output 


If an error occurs when converting a fixed-point number to a BCD number, the sta- 
tus bits OV Exception Bit Overflow and OS Exception Bit Overflow Stored are set to “1”, 
the ENO output is set to “O”, and with SCL the ENO tag is set to FALSE. 
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Conversion of fixed-point numbers (CONV) 


Name | Declaration | Datatype | Description 
LAD CONV FBD CONV EN : BOOL Enabling input 
DTT to DI2 DTT to DI2 ENO - BOOL Enabling output 
— EN ENO — — EN OUT — _IN INPUT Data type 7 | Input tag 
— IN OUT —— — IN ENO —- OUT OUTPUT Data type 2 | Output tag 


Function: The conversion function CONV is used to convert data types. The contents of the tag with 
data type DT1 present in the IN parameter are converted and transferred to the tag with data type DT2 
present in the OUT parameter. 


OUT := CONV(IN) 


The following combinations of data types are possible: 


Data type conversion for | from DT1 to DT2 AWL operation SCL statement 
Fixed-point numbers INT => DINT ITD INT_TO_DINT 
BCD16 ITB INT_TO_BCD 
DINT => REAL DTR DINT_TO_REAL 
BCD32 DTB DINT_TO_BCD 
BCD numbers BCD16 mp INT BTI BCD_TO_INT 
BCD32 => DINT BTD BCD_TO_DINT 
STL L #var_dint //Example of a conversion from DINT to REAL 
DTR 


ay #var_real 


SCL 
//Example of a conversion from DINT to REAL 


#var_real := DINT_TO_ REAL (#var_dint); 


Fig. 13.11 Function and representation of the conversion function CONV 


Master control relay (MCR) dependency 


The (actual) conversion function which changes the content of accumulator 1 is 
independent of the MCR function. Saving of the result of a conversion with an 
EN/ENO box (LAD, FBD) or with a transfer statement (STL) only takes place with the 
MCR functionality switched off. Zero is saved if the MCR function is switched on. 


Conversion of INT to DINT 


The function interprets the input value as a number with data type INT and trans- 
fers it to the right word of the output value. The signal state of bit 15 (the sign) of 
the input is transferred to bits 16 to 31 of the left word of the output value. 


The conversion of INT to DINT does not report any errors. 


Conversion of INT to BCD 


The function interprets the input value as anumber with data type INT and converts 
it into a BCD-coded number with 3 decades. The 3 right-justified decades represent 
the absolute value of the decimal number. The sign is present in bits 12 to 15. If all 
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bits are set to signal state “O”, the sign is positive; all bits set to signal state “1” 
means a negative sign. 


If the INT number is too large for conversion into a BCD number (> 999), a conver- 
sion does not take place and the function sets the status bits OV and OS to “1”. The 
binary result and the ENO output are then set to signal state “O” in the case of LAD 
and FBD and the ENO tag and the ENO output to FALSE in the case of SCL. 


Conversion of DINT to BCD 


The function interprets the input value as a number with data type DINT and con- 
verts it into a BCD-coded number with 7 decades as the output value. The 7 right-jus- 
tified decades represent the absolute value of the decimal number. The sign is pres- 
ent in bits 28 to 31. If all bits are set to signal state “O”, the sign is positive; all bits 
set to signal state “1” means a negative sign. 


If the DINT number is too large for conversion into a BCD number (> 9 999 999), a 
conversion does not take place and the function sets the status bits OV and OS to 
“1”, The binary result and the ENO output are then set to signal state “0” in the case 
of LAD and FBD and the ENO tag and the ENO output to FALSE in the case of SCL. 


Conversion of DINT to REAL 


The function interprets the input value as a number in DINT format and converts it 
into a number in floating-point format REAL. 


Since a number in DINT format has a greater accuracy than a number in REAL for- 
mat, rounding off may take place during conversion. It is rounded to the next inte- 
ger (corresponding to the ROUND function). 


The function does not report any errors. 


Conversion of BCD to INT 


The function interprets the input value as a BCD-coded number with 3 decades and 
converts it into an INT number. The 3 right-justified decades represent the absolute 
value of the decimal number. The sign is present in bits 12 to 15. Signal state “O” of 
these bits means “positive”, signal state “1” means “negative”. Only the signal state 
of bit 15 is considered during conversion. 


If a pseudo tetrad (numerical value 10 to 15 or A to F in hexadecimal representa- 
tion) is present in the BCD-coded number, the CPU signals a programming error 
and calls the organization block OB 121 Programming error. If this is not present, 
the CPU switches to the stop status. 


The function does not set any status bits. 


Conversion of BCD to DINT 


The function interprets the input value as a BCD-coded number with 7 decades and 
converts it into an DINT number. The 7 right-justified decades represent the abso- 
lute value of the decimal number. The sign is present in bits 28 to 31. Signal state 
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“0” of these bits means “positive”, signal state “1” means “negative”. Only the signal 
state of bit 31 is considered during conversion. 


If a pseudo tetrad (numerical value 10 to 15 or A to F in hexadecimal representa- 
tion) is present in the BCD-coded number, the CPU signals a programming error 
and calls the organization block OB 121 Programming error. If this is not present, 
the CPU switches to the stop status. 


The function does not set any status bits. 


13.6.3 Data type conversion of floating-point numbers 


The conversion functions convert data types of floating-point numbers into fixed- 
point numbers. Fig. 13.12 shows the general representation of the conversion func- 
tions in the various programming languages. They are represented as an EN/ENO 
box in the case of LAD and FBD, as operations in the case of STL which convert the 
value in accumulator 1, and in the case of SCL there are functions with an input 
value. 


The conversion options additionally offered by SCL are described in Chapter 10.5.5 
“Conversion functions” on page 413. 


Conversion of floating-point numbers 


Name | Declaration | Datatype | Description 
LAD Function FBD Function EN # BOOL Enabling input 
REAL to DINT REAL to DINT ENO 7 BOOL Enabling output 
— EN ENO — — OUT — _IN INPUT REAL Input tag 
——alN OUT — ——iiN ENO — = OUT OUTPUT DINT Output tag 


Function: The contents of the tag with data type REAL present in the IN parameter are converted and 
transferred to the tag with data type DINT present in the OUT parameter. 


OUT := Function (IN) 


The following data type conversions are possible for a floating-point number: 


Conversion from REAL to DINT 


LAD/FBD function 


STL operation 


SCL statement 


With rounding to the next integer 

With rounding to the next higher integer 
With rounding to the next smaller integer 
Without rounding 


ROUND 
CEIL 

FLOOR 
TRUNC 


RND 
RND+ 
RND- 
TRUNC 


ROUND 


TRUNC 


Conversion from REAL with rounding to DINT 
Conversion from REAL with rounding to INT 


REAL_TO_DINT 
REAL_TO_INT 


#var_ real := TRUNC(#var_ dint); 


//Example of a conversion from REAL to DINT 


STL L #var_ real //Example of a conversion from REAL to DINT 
TRUNC 
T #var_dint 

SCL 


Fig. 13.12 Function and representation of the conversion functions for floating-point 


numbers 
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Setting of status bits 


If an error occurs during conversion of a floating-point number to a fixed-point 
number, the status bits OV Exception Bit Overflow and OS Exception Bit Overflow 
Stored are set to “1”. The binary result BR and the ENO output are set to signal state 
“Q” in the case of LAD and FBD and the ENO tag and the ENO output to FALSE in the 
case of SCL. 


Master control relay (MCR) dependency 


The (actual) conversion function which changes the content of accumulator 1 is 
independent of the MCR function. Saving of the result of a conversion with an 
EN/ENO box (LAD, FBD) or with a transfer statement (STL) only takes place with the 
MCR functionality switched off. Zero is saved if the MCR function is switched on. 


Rounding to the next integer (ROUND, RND) 


The function interprets the input value as anumber in REAL format and converts it 
into anumber in DINT format. The function returns the nearest integer. If the result 
is exactly between an even number and odd number, the even number is selected: 
ROUND(0.5) = 0, ROUND(1.5) = 2. 


If the input value is greater than or less than the range permissible for a number in 
DINT format, or does not correspond to any number in REAL format, the function 
sets the status bits OV and OS to “1” and the ENO output to “0”. A conversion is not 
carried out in this case. 


Rounding to the next higher integer (CEIL, RND+) 


The function interprets the input value as a number in REAL format and converts it 
into a number in DINT format. The function returns an integer which is greater 
than or equal to the number to be converted. 


An error occurs if the input value is outside the DINT numerical range or is an 
invalid floating-point number. A conversion is not carried out in this case. 


Rounding to the next lower integer (FLOOR, RND-) 


The function interprets the input value as a number in REAL format and converts it 
into anumber in DINT format. The function returns an integer which is less than or 
equal to the number to be converted. 


An error occurs if the input value is outside the DINT numerical range or is an 
invalid floating-point number. A conversion is not carried out in this case. 


Without rounding (TRUNC) 


The function interprets the input value as anumber in REAL format and converts it 
into a number in DINT format. The function returns the whole number part of the 
number to be converted; the fractional part is truncated. 
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An error occurs if the input value is outside the DINT numerical range or is an 
invalid floating-point number. A conversion is not carried out in this case. 


Summary of conversion from REAL to DINT 


Table 13.9 shows the different effects of the conversion functions REAL to DINT. The 
range between -1 and +1 has been selected as an example. 


Table 13.9 Rounding modes when converting REAL numbers 


Input value Result 

REAL DW#16# ROUND/RND CEIL/RND+ FLOOR/RND- TRUNC 
1.0000001 3F80 0001 1 2 1 1 
1.00000000 3F80 0000 1 1 1 1 
0.99999995 3F7F FFFF 1 0 0 
0.50000005 3F00 0001 1 0 0 
0.50000000 3F00 0000 0 0 0 
0.49999996 3EFF FFFF 0 0 0 
5.877476E-39 0080 0000 0 0 0 
0.0 0000 0000 0 0 0 0 
-5.877476E-39 | 8080 0000 0 0 -1 0 
-0.49999996 BEFF FFFF 0 0 -1 0 
-0.50000000 BFOO 0000 0 0 -1 0 
-0.50000005 BFOO 0001 -1 0 -1 0 
-0.99999995 BF7F FFFF -1 0 -1 0 
-1.00000000 BF80 0000 -1 -1 -1 -1 
-1.0000001 BF80 0001 -1 -1 -2 -1 


13.6.4 Data type conversion for date/time with T_ CONV 


The conversion function for date and time converts tags with data types TIME, TOD, 
DATE, and DT. Fig. 13.3 shows the graphic representation of these functions. The 
date/timer functions are loadable standard functions (FC) which are represented as 
EN/ENO boxes in LAD and FBD and as block call with function value in STL and SCL. 


Data type conversion DT to DATE 


The data type conversion DT to DATE extracts the data format DATE (D#) from the 
format DATE_AND_TIME (DT#). DATE is between the limits DATE#1990-1-1 and 
DATE#2089-12-31. 


The function does not report any errors. 
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Data type conversion DT to TOD 


The data type conversion DT to TOD extracts the data format TIME OF_DAY (TOD#) 
from the format DATE_AND TIME (DT#). TOD is between the _ limits 
TOD#00:00:00.000 and TOD#23:59:59.999. 


The function does not report any errors. 


Data type conversion DT to INT 


The data type conversion DT to INT extracts the day of the week from the format 
DATE_AND_TIME (DT#). The day of the week is present in data format INT: 


1 =Sunday 

2 = Monday 

3 = Tuesday 

4 = Wednesday 
5 = Thursday 
6 =Friday 

7 = Saturday 


The function does not report any errors. 


Conversion function T-CONV 


apap of The following conversions are possible: 
time data types Data type DT1| Data type DT2 | SCL function Block 
T CONV DT DATE DT_TO_DATE FC6 DT_DATE 
a TOD DT_TO_TOD FC8 DT_TOD 
Buy We) Dike INT DT_TO_INT FC7 DT_DAY 
—_ OUT —— sSTIME TIME S5TIME_TO_TIME | FC 33 S5TITIM 
TIME SSTIME TIME_TO_SSTIME. | FC 40 TIM_SSTI 


Fig. 13.13 Graphic representation of the conversion function T_CONV 


Data type conversion S5TIME to TIME 


The data type conversion SSTIME to TIME converts the data format SSTIME into the 
format TIME. 


The function does not report any errors. 


Data type conversion TIME to SSTIME 


The data type conversion TIME to SSTIME converts the data format TIME into the 
format SSTIME. The value is rounded down during conversion. 


If the input parameter is greater than the SSTIME format which can be represented 
(greater than TIME# 02:46:30.000), SSTIME# 999.3 is output as result. The binary 
result BR and the ENO output are then set to “0” in the case of LAD and FBD and the 
ENO tag and the ENO output to FALSE in the case of SCL. 
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13.6.5 Data type conversion for data type STRING with S_ CONV 


The conversion function for data type STRING converts tags with data type STRING 
into numerical data types and vice versa. The graphic representation of this func- 
tion is shown in Fig. 13.14. The conversions are loadable standard functions (FC) 
which are represented as EN/ENO boxes in LAD and FBD and as block call with func- 
tion value in STL and SCL. 


Conversion function S-CONV 


Conversion of string The following conversions are possible: 
data types Data type DT1 |Data type DT2_ |SCL function Block 
S_CONV STRING INT STRING_TO_INT FC 38 STRNG_I 
DINT STRING_TO_DINT |FC37 STRNG_DI 
iit WO byZ REAL STRING_TO_REAL |FC39 STRNG_R 
—alN OUT —— INT STRING INT_TO_STRING FC 16 ISTRNG 
DINT STRING DINT_TO_STRING |FC5 DISTRNG 
REAL STRING REAL_TO_STRING FC 30 R_STRNG 


Fig. 13.14 Graphic representation of the conversion function S_ CONV 


If an error occurs during conversion, the binary result BR and the ENO output are 
set to “O” in the case of LAD and FBD and the ENO tag and the ENO output to FALSE 
in the case of SCL. A conversion is not carried out in this case. 


STRING tag in the temporary local data 


If you assign a STRING function value to a STRING tag which is located in the tem- 
porary local data, you must assign a defined value with the required length to this 
tag in the program (a default setting per declaration is not possible in the tempo- 
rary local data). 


Data type conversion INT to STRING 


The function converts a tag in INT format into a string. The string is shown preced- 
ed by a sign (number of digits plus sign). 


An error occurs if the destination tag is too short. 


Data type conversion DINT to STRING 


The function converts a tag in DINT format into a string. The string is shown pre- 
ceded by a sign (number of digits plus sign). 


An error occurs if the destination tag is too short. 
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Data type conversion REAL to STRING 
The function converts a tag in REAL format into a string. The string is shown with 
14 digits: 


+v.nnnnnnnE+xx + Sign 
v_ 1integer digit position 
n 7 decimal places 
x 2 exponent digits 


An error occurs if the destination tag is too short or if the input tag is an invalid 
floating-point number. 


Data type conversion STRING to INT 


The function converts a string into a tag in INT format. The first character in the 
string may be a sign or a digit, the characters which then follow must be digits. 


An error occurs if the length of the string is zero or greater than 6, if the string con- 
tains illegal characters, or if the converted value leaves the numerical range of INT. 


Data type conversion STRING to DINT 


The function converts a string into a tag in DINT format. The first character in the 
string may be a sign or a digit, the characters which then follow must be digits. 


An error occurs if the length of the string is zero or greater than 11, if the string 
contains illegal characters, or if the converted value leaves the numerical range of 
DINT. 


Data type conversion STRING to REAL 


The function converts a string into a tag in REAL format. The string must have the 
following format: 


+v.nnnnnnnE+xx + _ Sign 
v1 integer digit position 
n_ 7 decimal places 
x 2 exponent digits 


An error occurs if the length of the string is less than 14, if the string is not format- 
ted as shown above, or if the converted value leaves the numerical range of REAL. 


13.6.6 Data type conversion of hexadecimal numbers 


The ATH function converts a string of ASCII-coded characters into a string of hexa- 
decimal numbers. The HTA function converts a string of hexadecimal numbers into 
a string of ASCII-coded characters. The conversion functions are loadable standard 
functions (FC). They are represented as EN/ENO boxes in the case of LAD and FBD 
and as block calls with the conversion result as the function value in the case of STL 
and SCL. The graphic representation of the conversion functions is shown in Fig. 
13.15. 
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Conversion functions for hexadecimal numbers 


FC 94 FC 95 
Conversion from Conversion from 
ASCII to hexa hexa to ASCII 


Valid characters: 
ATH HTA Digits 0 to 9 
Uppercase letters A to F 


—_i RET_VAL——- ——IN RET_VAL —— 
—N OUT — ——N our — 
ATH HTA 
N parameter >| |___»| 
IN parameter Al A2 A3 A4 A5 H1 H2 H3 H4H5 x 
OUT parameter | H1 H2 H3 H4 H5 O Al A2 A3 A4 A5 


In the case of an odd quantity, a zero is 
written into the last half-byte. 


Fig. 13.15 Graphic representation of the ATH and HTA conversion functions 


Area pointers of data type POINTER which point to the first byte of the input or out- 
put data area are expected at the IN and OUT parameters. Example: 
P#DB10.DBX12.0. The N parameter with data type INT specifies the number of char- 
acters to be converted. 


ATH Conversion from ASCII to hexadecimal 


ATH converts a string present in ASCII code into a string in hexadecimal code. Only 
the digits 0 to 9 and the uppercase letters A to F are permissible. An illegal character 
is converted into zeros and an error message is output at the RET_VAL parameter. 


HTA Conversion from hexadecimal to ASCII 


HTA converts a string present in hexadecimal code into an ASCII-coded string. 
HTA does not report any errors. 


13.6.7 Scaling and unscaling 


SCALE converts a fixed-point number into a floating-point number and scales it 
between two limits in the process. UNSCALE unscales a floating-point number be- 
tween two limits and then converts it into a fixed-point number. 


SCALE and UNSCALE are loadable standard functions (FC). They are represented as 
EN/ENO boxes in the case of LAD and FBD and as block calls with RET_VAL as the 
function value in the case of STL and SCL. The graphic representation of the func- 
tions is shown in Fig. 13.16. 
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Conversion functions for scaling and unscaling 


FC 105 FC 106 
Scaling Unscaling 
SCALE UNSCALE DURES: 
Parameter |SCALE | UNSCALE 
—alN RET.VAL—- ——IN RET VAL——__ IN INT REAL 
— HILIM OUT — —HILIM ouT— HLLIM- |REAL | REAL 
LO_LIM |REAL_ | REAL 
_ ee —_ a BIPOLAR |BOOL | BOOL 
— BIPOLAR — BIPOLAR OUT REAL | INT 
SCALE 


Conversion formula: 
IN —- K1 
K2-K1 


OUT=| x (HI_LIM — LO_LIM) ] + LO_LIM K1 < IN < k2 
There are two different cases: 


1) The value of IN is unipolar in the range from 0 to +27 468; in this case the BIPOLAR parameter is "0" 
and the constants have the values K1 = 0 and K2 = +27 468. 


2) The value of IN is bipolar in the range from —468 to +27 468; in this case the BIPOLAR parameter is "1" 
and the constants have the values K1 = —468 and K2 = +27 468. 


UNSCALE 


Conversion formula: 


OUT =[ SGM (K2 -K1) ]+K1 
= |—_——_———_- x - + 
HL LIM-LO_LIM Bis OUI <= Be 


There are two different cases: 


1) The value of OUT is unipolar in the range from 0 to +27 468; in this case the BIPOLAR parameter 
is "0" and the constants have the values K1 = 0 and K2 = +27 468. 


2) The value of OUT is bipolar in the range from —468 to +27 468; in this case the BIPOLAR parameter 
is"1" and the constants have the values K1 = —468 and K2 = +27 468. 


Fig. 13.16 Graphic representation of the SCALE and UNSCALE functions 


SCALE Scale 


SCALE converts a fixed-point number between the limits 0 and +27 648 (unipolar) 
or between the limits -27 648 and +27 648 (bipolar) into a floating-point number 
and scales it between a lower limit and upper limit specified by you. Example of the 
application: conversion of an analog value from an analog input module into phys- 
ical units. 


If the value at IN is greater than 27 648, the upper limit is output and an error sig- 
naled. If the value at IN is less than K1 (see Fig. 13.16), the lower limit is output and 
an error signaled. If the lower limit is greater than the upper limit, the result is 
scaled inversely proportional to the input value. 


UNSCALE Unscale 


UNSCALE unscales a floating-point number between lower and upper limits and 
converts it into a fixed-point number between 0 and +27 648 (unipolar) or between 


542 


13.6 Conversion functions 


-27 648 and +27 648. Example of the application: conversion of physical units into 
an analog value for an analog output module. 


If the value at IN is greater than the value of the upper limit HI_LIM, the value of the 
constant K2 is output and an error signaled. If the value at IN is less than the lower 
limit LO_LIM, the value K1 (see Fig. 13.16) is output and an error signaled. 


13.6.8 Further conversion functions 


Further conversion functions include generation of an absolute value and negation 
(Fig. 13.17). 


Generation of absolute value, negation 


LAD | Function FBD Function Name | Declaration | Datatype | Description 
Be (de PSR EN ‘ BOOL Enabling input 
— EN ENO—— —— EN OUT —— ENO - BOOL Enabling output 
— IN Ot — — IN ENO —— 
IN INPUT Data type *)| Input tag 
OUT OUTPUT Data type *) | Result 
*) Same data types at IN and OUT 
Function: Data type: 
ABS Generation of absolute value REAL 
NEG Negation INT, DINT, REAL 
STL L IN Operation: Data type: 
Operation ABS Generation of absolute value REAL 
T our NEGI Negation INT 
NEGD Negation DINT 
NEGR Negation REAL 
SCL oyp := ABS CAN): //Moschuie walwe SCL function: : Data type: 
OUT := -IN; //Negation ABS Generation of absolute value INT, DINT, REAL 
- Negation INT, DINT, REAL 
(multiplication by —1) 


Fig. 13.17 Generation of absolute value and negation 


ABS’ Generation of absolute value 


The ABS function generates the absolute value of the input value and writes the 
result in the output value. With the data type REAL, ABS sets the sign of the mantis- 
sa to “0”, even with an invalid REAL number. 


The function does not report any errors and does not set any status bits. 


Negation, generation of two's complement 


The negation reverses the sign of the input value and outputs the result as output 
value. Execution of the function is equivalent to multiplication by -1. 


543 


13 Digital functions 


If the result is outside the permissible numerical range with the data types INT and 
DINT, the overflow condition code is set. With the data types INT and DINT, the func- 
tion sets the status bits CCO, CC1, OV, and OS (Table 13.10). 


Table 13.10 Status bits with the negation of a fixed-point number 


Status bits with INT DINT cco | cCc1 OV os 

The result is (-)32 768 (-)2 147 483 648 1 0 1 1 
—32 768 to -1 —2 147 483 649 to -1 1 0 0 - 
0 0 0 0 0 = 
+1 to +32 767 +1 to +2 147 483 647 0 1 0 - 


13.7 Shift functions 


13.7.1 General function description 


A shift function shifts the content of a tag bit by bit to the left or right. The shifted- 
out bits are lost in the case of shifting, or are applied again at the other side of the 
tag in the case of rotating. Fig. 13.18 shows the general representation of a shift 
function in the various programming languages. 


13.7.2 General execution of a shift function 


Data types of the tags with LAD and FBD 


The tag N has data type BYTE, WORD, or INT. The tags IN and OUT have data types 
WORD or DWORD for SHL; SHR has data types WORD, DWORD, INT, or DINT; and ROL 
and ROR have data type DWORD. 


Data types of tags for SCL 


The tag N has data type INT or DINT. The tags IN and OUT have data types BYTE, 
WORD, or DWORD. The data type on OUT has the same or greater width than the 
data type on IN. 


Shift number 


If the shift number = 0, the function is not executed and the input value is then also 
the output value. If the shift number is greater than 15 (with word by word shifting) 
or greater than 31 (with doubleword by doubleword shifting), shifting is carried out 
by the available digits. 


LAD, FBD, SCL: The shift number at the N input specifies the number of bit positions 
by which shifting is carried out. This can be a constant or variable. 
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Shift functions 


Name | Declaration | Datatype | Description 
LAD |Eynetion FBD Function EN = BOOL Enabling input 
Data type Data type ENO : BOOL Enabling output 
— EN ENO — — EN IN INPUT Data type *)} Input tag 
— IN OUT —— — IN OUT — N INPUT WORD, INT | Quantity 
—N —N ENO — OUT OUTPUT Data type *)} Result 
*) Same data type at IN and OUT 
Function: SHR Shift to right Data type: WORD, DWORD, INT, DINT 


SHL Shift to left 
SHR with WORD and DWORD: The bit positions that become free are filled with zeros. 


SHR with INT and DINT: The bit positions that become free are filled with bit 15 or bit 31. 
SHL: The positions that become free are filled with zeros. 


Function: ROR Rotate to right Data type: DWORD 
ROL Rotate to left 


ROR, ROL: The bit positions that become free are filled with the "shifted out" bit positions. 


STL Famean L N 
Operation with N parameter L IN 
1% @lGMv Operation without parameter 
Soa te 
A shift function changes the contents of accumulator 1: depending on the operation, 
the bits 0 to 15 (word by word) or 0 to 31 (doubleword by doubleword). The parameter for the 
operation specifies by how many bit positions shifting is carried out. If the operation has no 
parameters, the number of bit positions to be shifted is taken as a positive fixed-point number 
from accumulator 2. 
Function: Doubleword by doubleword Word by word 
(bits 0 to 31): (bits 0 to 15): 
Rotate to right RRD = 
Rotate to left RLD = 
Shift to right SRD SRW 
Shift with sign SSD SSI 
Shift to left SLD SLW 
Rotate to right through CC1 RRDA 
Rotate to left through CC1 RLDA _— 
SCL OUT := Function (IN := input tag, N := quantity); 


A shift function shifts the contents of the IN input tag by N bit positions. When shifting, the bit 
positions that become free are filled with zeros; when rotating, they are filled with the shifted out 
bit positions. 


Function: Rotate to right ROR Datatype: BYTE, WORD, DWORD 
Rotate to left ROL 
Shift to right SHR 
Shift to left SHL 


Fig. 13.18 Shift functions, representation, and principle of operation 
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STL: The shift number can be present as a parameter in the shift statement or in ac- 
cumulator 2. The content of accumulator 1 is shifted. In the case of word by word 
shifting, only the right word (bits 0 to 15) is shifted, the left word in accumulator 1 
remains uninfluenced. 


Setting of status bits 


The shift functions set the digital condition codes CCO, CC1, and OV (Table 13.11). 
With a shift quantity equal to zero, the condition code bits remain uninfluenced. 


Table 13.11 Status bits with a shift function 


Status bits | CCO | CC1 Ov os 


The “shifted-out” bit has the signal state “O” 0 0 0 - 
the signal state “1” 0 1 0 - 
The shift number is zero No change 


Master control relay (MCR) dependency 


The (actual) shift function which changes the content of accumulator 1 is indepen- 
dent of the MCR function. Saving of the result with an EN/ENO box (LAD, FBD) or 
with a transfer statement (STL) only takes place with the MCR functionality 
switched off. Zero is saved if the MCR function is switched on. 


13.7.3 Shift to right 


Shift to right with LAD and FBD 


The SHR shift function shifts the contents of the input tags present at the IN param- 
eter to the right by the number of bit positions specified by the shift number at the 
N input. If the input tag has data type WORD or DWORD, the bit positions that be- 
come free when shifting are padded with zeros. If the input tag has data type INT or 
DINT, the bit positions that become free when shifting are filled with the sign of the 
fixed-point number. 


Shift to right with STL 


The shift number is either specified as a parameter in the shift function or is present 
as a positive fixed-point number in accumulator 2. 


The SRW shift function shifts the contents of bits 0 to 15 of accumulator 1 bit by bit 
to the right. The bit positions that become free when shifting are padded with 
zeros. The left word of accumulator 1 remains unaffected. 


The SRD shift function shifts the entire contents of accumulator 1 bit by bit to the 
right. The bit positions that become free when shifting are padded with zeros. 
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Shift to right with sign with STL 


The shift number is either specified as a parameter in the shift function or is present 
as a positive fixed-point number in accumulator 2. 


The SSI shift function shifts the contents of bits 0 to 15 of accumulator 1 bit by bit 
to the right. The bit positions that become free when shifting are filled with the sign 
of the fixed-point number. The left word of accumulator 1 remains unaffected. 


The SSD shift function shifts the entire contents of accumulator 1 bit by bit to the 
right. The bit positions that become free when shifting are filled with the sign of the 
fixed-point number. 


Shift to right with SCL 


The SHR shift function shifts the contents of the tag present at the IN input bit by 
bit to the right by the number of positions specified by the shift number at the N 
input. The bit positions that become free when shifting are padded with zeros. 


13.7.4 Shift to left 


Shift to left with LAD and FBD 


The SHL shift function shifts the contents of the tag present at the IN input bit by bit 
to the left by the number of positions specified by the shift number at the N input. 
The bit positions that become free when shifting are padded with zeros. 


Shift to left with STL 


The shift number is either specified as a parameter in the shift function or is present 
as a positive fixed-point number in accumulator 2. 


The SLW shift function shifts the contents of bits 0 to 15 of accumulator 1 bit by bit 
to the left. The bit positions that become free when shifting are padded with zeros. 
The left word of accumulator 1 remains unaffected; carrying-over to bit 16 is not 
carried out. 


The SLD shift function shifts the entire contents of accumulator 1 bit by bit to the 
left. The bit positions that become free when shifting are padded with zeros. 


Shift to left with SCL 


The SHL shift function shifts the contents of the tag present at the IN input bit by bit 
to the left by the number of positions specified by the shift number at the N input. 
The bit positions that become free when shifting are padded with zeros. 


13.7.5 Rotate to right 


Rotate to right with LAD and FBD 


The ROR function shifts the contents of the tag present at the IN input bit by bit to 
the right by the number of positions specified by the shift number at the N input. 
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The bit positions that become free when shifting are filled with the signal state of 
the shifted-out positions. 


Rotate to right with STL 


The shift number is either specified as a parameter in the shift function or is present 
as a positive fixed-point number in accumulator 2. 


The RRD function shifts the entire contents of accumulator 1 bit by bit to the right. 
The bit positions that become free when shifting are filled by the shifted-out bit po- 
sitions. 


If the shift number = 0, the operation is not executed (nil operation NOP); if it is 32, 
the content of accumulator 1 is retained and status bit CC1 has the signal state of 
the last shifted-out bit (bit 0). If the shift number = 33, shifting is carried out by one 
position; with 34, shifting is by two positions, etc. 


Rotate to right with SCL 


The ROR function shifts the contents of the tag present at the IN input bit by bit to 
the right by the number of positions specified by the shift number at the N input. 
The bit positions that become free when shifting are filled with the signal state of 
the shifted-out positions. 


13.7.6 Rotate to left 


Rotate to left with LAD and FBD 


The ROL function shifts the contents of the tag present at the IN input bit by bit to 
the left by the number of positions specified by the shift number at the N input. The 
bit positions that become free when shifting are filled with the signal state of the 
shifted-out positions. 


Rotate to left with STL 


The shift number is either specified as a parameter in the shift function or is present 
as a positive fixed-point number in accumulator 2. 


The RLD function shifts the entire contents of accumulator 1 bit by bit to the left. 
The bit positions that become free when shifting are filled by the shifted-out bit po- 
sitions. 


If the shift number = 0, the operation is not executed (nil operation NOP); if it is 32, 
the content of accumulator 1 is retained and status bit CC1 has the signal state of 
the last shifted-out bit (bit 0). If the shift number = 33, shifting is carried out by one 
position; with 34, shifting is by two positions, etc. 


Rotate to left with SCL 


The ROL function shifts the contents of the tag present at the IN input bit by bit to 
the left by the number of positions specified by the shift number at the N input. The 
bit positions that become free when shifting are filled with the signal state of the 
shifted-out positions. 
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13.7.7 Rotating by the condition code bit CC1 (STL) 


The RLDA shift function shifts the entire contents of accumulator 1 by 1 bit to the 
left. The bit position that becomes free when shifting (bit 0) is filled with the signal 
state of status bit CC1. Status bit CC1 contains the signal state of the shifted-out bit 
(bit 31); status bit CCO is set to “0”. 


The RRDA shift function shifts the entire contents of accumulator 1 by 1 bit to the 
right. The bit position that becomes free when shifting (bit 31) is filled with the sig- 
nal state of status bit CC1. Status bit CC1 contains the signal state of the shifted-out 
bit (bit 0); status bit CCO is set to “O”. 


13.8 Logic functions 


The (digital) logic functions comprise the following functions: 

> Word logic operations according to AND, OR, and exclusive OR 
> Invert 

> Code bit and set bit number (DECO, ENCO) 

> Selection and limiting functions (SEL, MIN, MAX, LIMIT) 


Word logic operations and the invert function are implemented as sequences of 
statements, the other logic functions are loadable functions (FC) which are repre- 
sented as EN/ENO boxes in LAD and FBD and as a function with function value in STL 
and SCL. 


13.8.1 Word logic operations 


General processing of a word logic operation 


A word logic operation links the values of two digital tags bit by bit according to 
AND, OR, or exclusive OR. Fig. 13.19 shows the general representation of a digital 
logic operation in the various programming languages. 


FBD and LAD use boxes with EN/ENO for the word logic operation. STL links the con- 
tents of accumulators 1 and 2 or the content of accumulator 1 to a constant (see 
Chapter 9.5.7 “Word logic operations” on page 377). With SCL, the word logic oper- 
ation is a logic expression. 


All tags involved in the word logic operation have the same data type; with LAD, 
FBD, and STL, these are tags of word and doubleword width; with SCL, these are the 
data types BYTE, WORD, and DWORD. 


The word logic operation generates the result bit by bit. Bit 0 of the IN1 input is 
linked to bit 0 of the IN2 input; the result is saved in bit 0 of the OUT output. The 
same logic operation takes place with bit 1, bit 2, etc. up to bit 15 or bit 31. 


549 


13 Digital functions 


Logical operations 


LAD FBD 


Function Function 
Data type Data type 
— EN ENO — — EN 
— IN1 OUT —— — IN1 OUT — 
— IN2 — IN2 ENO — 
Function: 


AND Bit by bit AND operation 


Name | Declaration | Datatype | Description 

EN - BOOL Enabling input 
ENO - BOOL Enabling output 
IN1 INPUT Data type *)| Input tag 1 

IN2 INPUT Data type *)} Input tag 2 

OUT OUTPUT Data type *)} Result 


*) Same data type at IN1, IN2, and OUT 


Gating of the individual bits: 


. “py” “py Ce Bd “aq 
OR _ Bit by bit OR operation Pe of the IN1 parameter ae io f a ee 
XOR Bit by bit exclusive OR operation Bitofthe IN2 parameter “0” “1” “0” “1 
Result with AND Ee AE ee 
Data type: Result with OR MQ” qr eg gn 
WORD, DWORD F eI ae 
Result with XOR OP Mee aes 0) 
STL 
ty, JGNIE aN 
L IN2 Operation with parameter 
Operation without parameter Ie OU 
Mk {QML 


A word logic operation changes the contents of accumulator 1: depending on the operation, 

the bits 0 to 15 (word by word) or 0 to 31 (doubleword by doubleword). If the operation has no 
parameters, the contents of accumulators 1 and 2 are gated. If the operation has a parameter, the 
contents of accumulator 1 are gated with the parameter, and the result written into accumulator 1. 


Operation: Data types: 
AW, AD AND operation WORD, DWORD 
OW, OD OR operation 
XOW, XOD _ Exclusive OR operation 
SCL (OUR 3= INL Funceion INz¢: Function: 
AND AND operation 


OR OR operation 
XOR_ Exclusive OR operation 


Data types: 
BYTE, WORD, DWORD 


Fig. 13.19 Representation and function of word logic operations 


Setting of status bits 


The word logic operations set the status bits CCO and OV to signal state “O”. If the 
result of the word logic operation is zero, status bit CC1 is set to “0”, otherwise to 


“1” (Table 13.12). 


Table 13.12 Status bits with a word logic operation 


Status bits | CCO | CC1 Ov os 
The result of the word logic operation —_is zero 0 0 0 - 
is not zero 0 1 0 - 
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Master control relay (MCR) dependency 


The (actual) word logic operation which changes the content of accumulator 1 is in- 
dependent of the MCR function. Saving of the result with an EN/ENO box (LAD, FBD) 
or with a transfer statement (STL) only takes place with the MCR functionality 
switched off. Zero is saved if the MCR function is switched on. 


AND logic operation 


The AND logic operation links the individual bits of the input tags according to an 
AND logic operation. The individual bits only have signal state “1” in the result if 
the corresponding bits of the two values to be linked have signal state “1”. 


A word by word AND logic operation with STL (AW) only uses the right words (bits 
0 to 15) of the accumulators. The contents in the left words are not changed. 


Since the bits with signal state “O” in the second input tag (“mask”) also set these 
bits in the result to “0” independent of the assignment of these bits in the first input 
tag, one also says that these bits are “masked”. This masking is the main application 
of the (digital) AND logic operation. 


OR logic operation 


The OR logic operation links the individual bits of the input tags according to an OR 
logic operation. The individual bits only have signal state “O” in the result if the cor- 
responding bits of the two values to be linked have signal state “O”. 


A word by word OR logic operation with STL (OW) only uses the right words (bits 0 
to 15) of the accumulators. The contents in the left words are not changed. 


Since the bits with signal state “1” in the second input tag (“mask”) also set these 
bits in the result to “1” independent of the assignment of these bits in the first input 
tag, one also says that these bits are “unmasked”. This unmasking is the main ap- 
plication of the (digital) OR logic operation. 


Exclusive OR logic operation 


The exclusive OR logic operation links the individual bits of the input tags accord- 
ing to an exclusive OR logic operation. The individual bits only have signal state “1” 
in the result if only one of the corresponding bits of the two values to be linked has 
signal state “1”. If a bit in the second input tag has signal state “1”, the inverted sig- 
nal state of the bit of the first input tag is present at this position in the result. 


A word by word exclusive OR logic operation with STL (XOW) only uses the right 
words (bits 0 to 15) of the accumulators. The contents in the left words are not 
changed. 


Only those bits have signal state “1” in the result which have different signal states 
in both tags prior to the digital exclusive OR logic operation. Detection of the bits 
with different signal states or the “negating” of the signal states of individual bits 
are the main applications of the (digital) exclusive OR logic operation. 
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13.8.2 Invert 


Inverting negates the value of a tag bit by bit; signal state “1” becomes signal state 
“QO” and vice versa. Fig. 13.20 shows the representation of the function in the vari- 
ous programming languages. 


LAD INV FBD INV Name | Declaration | Datatype | Description 
rsa tapers Doki tapers EN . BOOL Enabling input 
—-& ENC) ia = OUT — eno |- BOOL Enabling output 
— IN OUT — — IN ENO —— 
IN INPUT Data type *) | Input tag 
OUT OUTPUT Data type *) | Result 
*) Same data types at IN and OUT 
Function: Data types: 
INV Invert INT, DINT 
ST L IN| Operation: Data types: 
Olpowelie Novel INVI Invert INT 
ule INVD Invert DINT 
SCL OUT := NOT IN; //Invert Function: Data types: 
NOT Invert (negate) BOOL, WORD, DWORD 


Fig. 13.20 Representation of inverting 


The function does not report any errors and does not set any status bits. 


Inverting with STL 


The INV_I function negates the content of the right word in accumulator 1 (bits 0 
to 15). The left word is not affected. 


The INV_DI function negates the content of the complete accumulator 1 (bits 0 
to 31). 


Inverting with SCL 


The NOT operator (Boolean negation) negates the bits of the following operand or 
the result of the following expression. 


13.8.3 Code bit and set bit number 


The functions process individual bits in a tag. They are loadable standard functions 
(FC). They are represented as EN/ENO box in the case of LAD and FBD and as a block 
call without function value in the case of STL and SCL. The graphic representation 
of the function is shown in Fig. 13.21. 


DECO Code bit 


DECO sets the bit whose number is at the IN parameter in the bit sequence tag at 
the OUT parameter. All other bits are set to signal state “O”. Depending on the data 
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Set a coded bit 


DECO ENCO DECO Decode, set bit 
DWORD DWORD ENCO Encode, scan bit 
— IN OUT — — IN OUT — 
DECO 
Function: rt IN parameter 
The bit in the OUT parameter is set to "1" OUT parameter 
whose number is specified by the IN Foire’ os toe Ga ea 3 2 1b 0 


parameter. The other bits are reset to "0". i (Ga WL 
ON FON FON FON FON ON FON NON FON Hs KOs KON TOT TOs FON KO: 


ENCO 


Function: IN parameter a OUT parameter 
The number of the least significant bit with 3 3210 
signal state "1" in the IN parameter is output ; Sete dice her lteedie 

in the OUT parameter. ONLOT EON Ka On Ma On FON KON IA KOs RON ROR FOS RON FO 


Fig. 13.21 Representation and description of the DECO and ENCO functions 


type at the OUT parameter, only some of the bits are selected in the IN parameter: 
3 bits (range 0 to 7) for BYTE, 4 bits (range 0 to 15) for WORD, and 5 bits (range 0 
to 31) for DWORD. 


DECO does not report any errors. 


ENCO Set bit number 


ENCO searches for the first bit set to signal state “1” in the bit sequence tag at the 
IN parameter starting from the right (starting with bit number 0) and outputs its 
number at the OUT parameter. If no bit is set, the number 0 is output at the OUT 
parameter and signal state “O” at the ENO output. 


13.8.4 Selection and limiting functions 


The selection and limiting functions select a tag or limit its value. They are imple- 
mented with loadable standard functions (FC) with LAD and FBD and with sequenc- 
es of statements with SCL. They are represented as EN/ENO box in the case of LAD 
and FBD and as a block call with the OUT parameter as the function value in the case 
of STL and SCL. The graphic representation of the functions is shown in Fig. 13.22. 


If one of the following errors occurs, the selection and limiting functions leave the 
function value unchanged and set the binary result BR and the ENO output to signal 
state “O” in the case of LAD and FBD, and the ENO tag and the ENO output to FALSE 
in the case of SCL: 


> A parameterized tag has an invalid data type 
> All parameterized tags do not have the same data type 


> AREAL tag does not represent a valid floating-point number 
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Selection and limiting functions 


SEL SEL Selecting (FC 36) 
Data type The G parameter selects the INO (with signal state "0") or IN1 
(with signal state "1") input, and transfers its value to the 
—s OUT — OUT parameter. All elementary data types (except BOOL) are 
— INO permissible. 
— ih 
LIMIT LIMIT Limit value (FC 22) 
Data type LIMIT limits the value in the IN parameter to the limits MN 
(lower limit) and MX (upper limit), and outputs the value in the 
— MN OUT — OUT parameter. All parameters have the same data type (INT, DINT, 
— IN REAL; with SCL, additionally TIME, DATE, TOD). 
— MX 
Function MAX Determine maximum (FC 25) 
Data type MAX transfers the largest of the three input values IN1, IN2 and 
IN3 to the OUT parameter. All parameters have the same data type 
— IN OUT —— (INT, DINT, REAL). 
—ie With SCL, the data types TIME, DATE, TOD are additionally 
— IN3 permissible, and MAX can have up to 32 inputs. 
MIN Determine minimum (FC 27) 
MIN transfers the smallest of the three input values IN1, IN2 and 
IN3 to the OUT parameter. All parameters have the same data type 
(INT, DINT, REAL). 
With SCL, the data types TIME, DATE, TOD are additionally 
permissible, and MIN can have up to 32 inputs. 
Mux MUX Multiple selection 
Data type Only available with SCL: 
— INo ouT — Depending on the assignment of the K parameter, MUX outputs a 
tag present at the INx and INELSE inputs to the OUT output. 

— IN1 Up to 32 input parameters INO to IN31 can be used. If the value in 
—ine the K parameter is larger than the number of inputs INx, the value 
in the INELSE parameter is output. 

— IN31 All data types are permissible: BYTE, WORD, DWORD, INT, DINT, 
— INELSE REAL, TIME, DATE, TOD, DT, STRING POINTER, and ANY. 


Fig. 13.22 Representation and description of the selection and limiting functions 


SEL Binary selection 


SEL selects one of two tag values (INO and IN1) depending on a switch (para- 
meter G). Tags with elementary data types are permissible as input values at the 
INO and IN1 parameters. Both input tags (actual parameters) and the output tag 
must have the same data type. 


With SCL, the data types at INO, IN1, and OUT must belong to the same class of data 
type (BYTE, WORD, DWORD or INT, DINT, REAL) and the output tag must have the 
“most significant” data type. 
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LIMIT Limiter 


LIMIT limits the numerical value of the IN tag to the limits specified in the MN and 
MX parameters. Tags of data types INT, DINT, REAL are permissible as input values 
and additionally the data types TIME, DATE, and TOD with SCL. All input tags and 
the output tag must have the same data type or - with SCL - belong to the same 
class of data type (INT, DINT, REAL) and the output tag must have the “most signif- 
icant” data type. The lower limit (MN parameter) must be smaller than the upper 
limit (MX parameter). 


The function signals an error if - in addition to the errors mentioned above - the 
lower limit MN is not smaller than the upper limit MX. 


MAX Maximum selection 


MAX selects the largest of three numerical tag values in the case of LAD, FBD, and 
STL. With SCL, up to 32 input parameters can be programmed. Tags of data types 
INT, DINT, REAL are permissible as input values and additionally the data types 
TIME, DATE, and TOD with SCL. All input tags and the output tag must have the 
same data type or - with SCL - belong to the same class of data type (INT, DINT, 
REAL) and the output tag must have the “most significant” data type. 


MIN Minimum selection 


MIN selects the smallest of three numerical tag values in the case of LAD, FBD, and 
STL. With SCL, up to 32 input parameters can be programmed. Tags of data types 
INT, DINT, REAL are permissible as input values and additionally the data types 
TIME, DATE, and TOD with SCL. All input tags and the output tag must have the 
same data type or - with SCL - belong to the same class of data type (INT, DINT, 
REAL) and the output tag must have the “most significant” data type. 


MUX (only for SCL) 


Depending on the value of the K parameter, MUX selects a tag present at the INx or 
INELSE inputs and outputs it at the OUT parameter. Up to 32 input parameters 
(INO to IN31) can be programmed. The selection starts with K = 0 (corresponding to 
INO) and ends with K = 31 (corresponding to IN31). If the value of K is outside the 
programmed inputs, the value at INELSE is transferred to the OUT output. If INELSE 
is not programmed in this case, the ENO tag and the ENO output are set to FALSE. 


Tags of all elementary data types (except BOOL) and tags with data types DT, 
STRING, POINTER, and ANY are permissible as input values. All input tags and the 
output tag must have the same data type or belong to the same class of data type 
(BYTE, WORD, DWORD, or INT, DINT, REAL) and the output tag must have the “most 
significant” data type. 
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13.9 Functions for strings 


A string can be processed with the following functions: 


LEN Outputs the length of a string (FC 21) 
CONCAT Combines two strings together (FC 2) 
LEFT Outputs the left part of a string (FC 20) 
RIGHT Outputs the right part of a string (FC 32) 
MID Outputs the middle part of a string (FC 26) 


DELETE Deletes part of a string (FC 4) 

INSERT Inserts characters into a string (FC 17) 

REPLACE _ Replaces characters in a string (FC 31) 

FIND Outputs the position of a searched character (FC 11) 


The string functions are implemented using system functions. They are represent- 
ed as EN/ENO box in the case of LAD and FBD and as a block call with the OUT pa- 
rameter as the function value in the case of STL and SCL. The graphic representa- 
tion of the functions is shown in Fig. 13.23. 


All functions for processing strings expect a valid string with plausible values in the 
length bytes (maximum length < 254, current length < maximum length) at the 
parameters with data type STRING. If you do not assign default values to strings 
when declaring, they are automatically assigned as empty strings (current 
length = 0) with the maximum length (= 254). 


Please note that strings which you declare in the temporary local data cannot be as- 
signed default values. In this case you must assign a defined value (can also be an 
empty string) to a STRING tag in the program before you use the STRING tag togeth- 
er with a function or block. 


LEN Length of a STRING tag 


LEN outputs the current length of a string (number of valid characters) as a func- 
tion value. An empty string has a length of zero. The maximum length is 254. 


Except for incorrect parameter assignment, the function does not report any errors. 


FIND Find in a STRING tag 


FIND delivers the position of the second string (IN2) within the first string (IN1). 
The search starts on the left; the first occurrence of the string is reported. If the sec- 
ond string is not found in the first, zero is returned. 


Except for incorrect parameter assignment, the function does not report any errors. 


LEFT Left part of a STRING tag 


LEFT delivers the first L characters of a string. If Lis greater than the current length 
of the STRING tag, the input value is returned. With L = 0 and with an empty string 
as the input value, an empty string is returned. 
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Processing of strings 


LEN LEN Output length of a character string (FC 21) 
STRING LEN determines the length of the string in the IN parameter and 
if aie outputs it in the OUT parameter. 
CONCAT CONCAT Combine character strings together (FC 2) 
STRING CONCAT combines the strings present in the IN1 and IN2 
parameters together, and outputs them as a single string in the 
— INI OUT — OUT parameter. 
— IN2 
LEFT LEFT Output left part of character string (FC 20) 
STRING LEFT extracts the first characters (the number is specified in 
the L parameter) from the string present in the IN parameter, 
— IN OUT — and outputs them in the OUT parameter. 
— ie 
RIGHT RIGHT Output right part of character string (FC 32) 
STRING RIGHT extracts the last characters (the number is specified in 
the L parameter) from the string present in the IN parameter, 
— IN OUT — A 
and outputs them in the OUT parameter. 
— ie 
MID MID Output middle part of character string (FC 26) 
STRING MID removes a part of the string present in the IN parameter 
whose start position is specified in the P parameter and length in 
— IN OUT — the L parameter, and outputs it in the OUT parameter. 
— ie 
—Pp 
DELETE DELETE _ Delete part of character string (FC 4) 
STRING DELETE deletes a part of the string present in the IN parameter 
whose start position is specified in the P parameter and length in 
— IN OUT —— the L parameter, and outputs the remainder "shifted together" in 
— the OUT parameter. 
—Pp 
INSERT INSERT Insert character string (FC 17) 
STRING INSERT inserts the string present in the IN2 parameter into the 
string present in the IN1 parameter at the position specified in 
— INI OUT — the P parameter, and outputs the result in the OUT parameter. 
— IN2 
—Pp 
REPLACE REPLACE Replace part of character string (FC 31) 
STRING REPLACE replaces part of the string present in the string in 
the IN1 parameter by the string present in the IN2 parameter, and 
— INI OUT — outputs the result in the OUT parameter. The replaced part of the 
— IN2 string commences at the position specified in the P parameter, 
—ih and has as many characters as specified in the L parameter. 
—Pp 
FIND FIND — Find part of character string (FC 11) 
STRING FIND determines the position of the string present in 
the IN2 parameter in the string present in the IN1 parameter, 
— INI OUT — and outputs it in the OUT parameter. 
— IN2 


Fig. 13.23 Description of the functions for processing of strings 
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If Lis negative, an empty string is returned and the binary result BR and the ENO 
output are set to “O”. 


RIGHT Right part of a STRING tag 


RIGHT delivers the last L characters of a string. If L is greater than the current 
length of the STRING tag, the input value is returned. With L = 0 and with an empty 
string as the input value, an empty string is returned. 


If Lis negative, an empty string is returned and the binary result BR and the ENO 
output are set to “O”. 


MID Middle part of a STRING tag 


MID delivers the middle part of a string (L characters starting at the P character). If 
the sum of L and P exceeds the current length of the STRING tag, a string is returned 
from the P character up to the end of the input value. 


In all other cases (P is outside the current length, P and/or L are equal to zero or neg- 
ative), an empty string is output and the binary result BR and the ENO output are 
set to “0”. 


CONCAT Combination of two STRING tags 
CONCAT combines two STRING tags into one string. 


If the result string is longer than the tag at the output parameter, it is limited to the 
maximum set length and the binary result BR and the ENO output are set to “O”. 


INSERT Insert in a STRING tag 


INSERT inserts the string at the IN2 parameter into the string at the IN1 parameter 
after the character at position P. If P is equal to zero, the second string is inserted 
before the first string. If P is greater than the current length of the first string, the 
second string is appended to the first one. 


If P is negative, an empty string is output and the binary result BR and the ENO out- 
put are set to “O”. The binary result and the ENO output are also set to “O” if the re- 
sult string is longer than the tag at the output parameter; in this case the result 
string is limited to the maximum set length. 


DELETE Delete in a STRING tag 


DELETE deletes L characters in a string starting at the P character. If L and/or P are 
equal to zero or if P is greater than the current length of the input string, the input 
string is returned. If the sum of L and P is greater than the input string, the string 
is deleted up to the end. 


If L and/or P is negative, an empty string is output and the binary result BR and the 
ENO output are set to “0”. 
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REPLACE Replace in a STRING tag 


REPLACE replaces L characters in the first string (IN1) starting at the character at 
position P by the second string (IN2). If L is equal to zero, the first string is re- 
turned. If P is equal to zero or one, the string is replaced from the first character 
(inclusive). If P is outside the first string, the second string is appended to the first 
string. 


If L and/or P is negative, an empty string is output and the binary result BR and the 
ENO output are set to “0”. The binary result BR and the ENO output are also set to 
“0” if the result string is longer than the tag at the output parameter; in this case 
the result string is limited to the maximum set length. 
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14 Program flow control 


This chapter describes the functions for controlling program execution, indepen- 
dent of the programming language as far as possible. The Chapters 7 “Ladder logic 
LAD” on page 283, 8 “Function block diagram FBD” on page 315, 9 “Statement list 
STL’ on page 348, and 10 “Structured Control Language SCL’ on page 397 describe 
how you can program the functions using the individual programming languages 
and what special features exist. 


The status bits (LAD, FBD, STL) and the ENO tag (SCL) provide information on the 
result of an arithmetic function or on any errors, for example exceeding a numeri- 
cal range. You can directly integrate the signal state of the status bits or the ENO tag 
into your program using binary logic operations or program branches. 


The jump functions permit program branching depending on the status bits, the 
result of logic operation, or the binary result. With STL, you can execute the jumps 
with a calculated jump width or you can easily implement program loops. The con- 
trol statements which are only present with SCL for controlling program execution 
are described in Chapter 10.6.3 “Control statements” on page 419. 


The block functions are used to structure the user program. The organization 
blocks are the interface to the CPU's operating system. The function blocks and 
functions represent individual programs sections for a complete function. Func- 
tion blocks and functions can be parameterized and thus used repeatedly with dif- 
ferent tags. 


A further possibility for influencing program execution is provided by the master 
control relay (MCR). Originally developed for contactor controls, LAD, FBD, and STL 
provide software emulation of this program control possibility. 


Table 14.1 Status bits with LAD, FBD, and STL; assignment of status word 


Bit Binary flags Bit Digital flags 

0 IFC First scan 4 Os Stored overflow 

1 RLO Result of logic operation 5 Ov Overflow 

2 STA Status 6 cco Condition code bit CCO 
3 OR Status bit OR 7 cc1 Condition code bit CC1 
8 BR Binary result 
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14.1 Status bits 


The status bits are binary flags (condition code bits) which the CPU uses to control 
the binary logic operations and sets during digital processing. You can also scan 
these status bits or specifically influence them with the programming languages 
LAD, EBD, and STL. 


SCL uses the ENO tag for the error scan (see Chapter 10.6.1 “Working with the ENO 
tag” on page 416). 


14.1.1 Description of the status bits 


Table 14.1 shows the available status bits. The first column shows the bit number 
in the status word. The CPU uses the binary flags for controlling the binary logic op- 
erations. The digital flags mainly indicate the results of arithmetic and math func- 
tions. 


The programming significance of the status bits becomes important above all with 
the programming language STL. How the processing of binary statements influenc- 
es the status bits is described in Chapter 14.1.2 “Controlling the status bits” on page 
563. 


First scan /FC 


The /FC status bit steers the binary logic operation in a logic control. An operation 
step always starts with /FC = “0” and a binary scan statement, the first input bit scan. 
The first input bit scan with LAD corresponds to the first contact in a network, with 
FBD to the first binary function input, and with STL to the first scan operation fol- 
lowing a conditional operation. The first input bit scan sets /FC = “1”. 


An operation step ends with a conditional operation dependent on the result of log- 
ic operation, for example a binary value assignment, a jump depending on the re- 
sult of logic operation, or a block change. These set /FC = “0”. The next binary scan 
is then the start of a new logic operation. 


Result of logic operation RLO 


The status bit RLO is the intermediate memory for binary logic operations. During 
the first input bit scan, the CPU transfers the scan result to the result of logic oper- 
ation, which is mapped in the status bit RLO. With each subsequent scan, the CPU 
links the scan result to the saved result of logic operation, and again saves the result 
in the status bit RLO. 


The result of logic operation is used to control memory, timer, and counter func- 
tions and to execute certain jump functions. The result of logic operation corre- 
sponds with LAD to the current flowing in the current path (RLO = “1” is equivalent 
to “current flowing”). 


Status STA 


The status bit STA corresponds to the signal state of the addressed binary operand 
or - with STL - to the scan result with the binary logic operations. 
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With the memory functions (set, reset, assign), the value of STA is the same as the 
written value or — if no write operation takes place, e.g. with RLO = “0” or MCR active 
- corresponds to the value of the addressed (and unmodified) binary operand. 


With edge evaluations FP or FN, the value of the RLO prior to the edge evaluation is 
stored in STA. All other binary statements/functions set STA = “1”; and also the bi- 
nary flag-dependent jumps JC, JCN, JBI, JBIN with STL (exception: CLR sets STA = 
“O”). 


The status bit STA does not affect program execution. It is displayed with the test 
functions of the programming device, e.g. with the program status, so that you can 
use it to trace logic sequences or for troubleshooting. 


Status bit OR 


The status bit OR saves the result of a fulfilled AND logic operation and indicates to 
a subsequent OR logic operation that the result is already available (in association 
with the O statement in an AND before OR logic operation). All other bit-processing 
statements (binary functions) reset the status bit OR. An example is shown in 
Chapter 14.1.2 “Controlling the status bits” on page 563. 


Overflow OV 


The status bit OV indicates a numerical range overflow or the use of invalid float- 
ing-point numbers. The following functions influence the status bit OV: arithmetic 
functions, math functions, some conversion functions, and the comparison func- 
tions with data type REAL. 


You can evaluate the status bit OV using scan statements or — with STL - using the 
jump statement JO. 


Stored overflow OS 


The status bit OS saves a setting of status bit OV: Whenever the CPU sets the status 
bit OV, it also sets the status bit OS. However, whereas OV is reset by the next cor- 
rectly executed operation, OS remains set. You are therefore provided with the op- 
portunity to subsequently evaluate a numerical range overflow or an operation 
with an invalid floating-point number in your program. 


You can evaluate the status bit OS using scan statements or - with STL - using the 
jump statement JOS. JOS or a block change resets the status bit OS. 
Condition code bits CCO and CC1 


The status bits CCO and CC1 provide information on the result of a comparison 
function, an arithmetic or math function, a word logic operation, or the shifted-out 
bit of a shift function. 
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You can evaluate all combinations of the status bits CCO and CC1 using jump func- 
tions and scan statements (see later in this chapter). 


Binary result BR 


The binary result BR is an additional memory for the result of logic operation. In the 
case of LAD, FBD, and SCL, it supports implementation of the EN/ENO mechanism 
with block calls. 


You can also set or reset the status bit BR yourself and evaluate it with binary scans 
or - with STL - with jump statements. In the case of SCL, you scan the binary result 
using the ENO tag. 


Status word STW 


The status word contains all status bits. With STL, you can load it into accumulator 1 
or write it with a value from accumulator 1. 


L STW //Load status word 
1 Sera 
T STW //Transfer to status word 


The assignment of the status word with the status bits can be found in Table 14.1 
on page 560. 


You can use the status word to scan the status bits or to set them as required. You 
can thus save a current status word or commence a program section with a specific 
assignment of the status bits. 


14.1.2 Controlling the status bits 


The top part of Table 14.2 shows controlling of the binary flags using the example 
of an operation step, and the bottom part shows setting of the digital flags for arith- 
metic functions. 


The following digital functions influence the status bits CCO, CC1, OV, and OS: 
Comparison functions (see Chapter 13.3 “Comparison functions” on page 518) 
Arithmetic functions (see Chapter 13.4 “Arithmetic functions” on page 521) 
Math functions (see Chapter 13.5 “Math functions” on page 527) 

Conversion functions (see Chapter 13.6 “Conversion functions” on page 531) 


Shift functions (see Chapter 13.7 “Shift functions” on page 544) 


Word logic operation (see Chapter 13.8.1 “Word logic operations” on page 549) 


The specified chapters describe how these functions influence the status bits. 


14.1.3 Setting and resetting the result of logic operation 


With STL, the SET statement sets the result of logic operation to signal state “1” and 
also the status bit STA to signal state “1”. 
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Table 14.2 Example of influencing the status bits with STL 


Binary flags: 
STL statements IFC RLO STA OR Remarks 
= %M10.0 0 x x 0 
A %14.0 1 1 1 0 %14.0 is "1" The part shaded in gray 
AN %I4.1 1 1 0 0 %14.1 is "O" is an operation step 
O 1 1 1 1 
O %14.2 1 1 0 (0) %14.2 is "O" 
ON %I4.3 1 a 0 ) %14.3 is "O" 
= %Q8.0 0 {| i, 0 %Q8.0 to "1" 
R %Q8.1 0 1 0 (0) %Q8.1 to "0" 
Ss %Q8.2 0 1 1 (0) %Q8.2 to "1" 
A %15.0 1 x x 0 
Digital flags: 
STL statements cco cc1 OV os Remarks 
T %MW10 x x x x 
L +12 XG x x x 
L +15 x x x x 
-| 1 0 0 0 Result negative 
L +20000 1 0 (0) 6) 
I il (0) 1 i) Overflow OV and OS to "1" 
L +20 1 il 1 1 
+1 (0) 1 0 1 OV becomes "0" OS remains "1" 
T %MW20 (6) 1 0 t 
L %MW40 0 1 0 1 


With STL, the CLR statement sets the result of logic operation to signal state “0” and 
also the status bit STA to signal state “0”. 


Both statements are executed independent of conditions. SET and CLR also reset the 
status bits OR and /FC so that a new logic operation starts with the next scan follow- 
ing SET or CLR (Fig. 14.1). 


You can use SET to program absolute setting or resetting of a binary operand, and 
CLR to reset e.g. edge trigger flags: 


SET 

Ss $M8.0 //Bit memory is set 

R SM8.1 //Bit memory is reset 

CLR 

CU %Cl1 //Reset edge memory bit for “Count up” 


Direct setting and resetting of the result of logic operation is also useful in conjunc- 
tion with SIMATIC timer and counter functions. To start a timer or counter function, 
you require a change in the RLO from “0” to “1” (note that you also require a positive 
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Setting and resetting the result of logic operation (STL) 


With STL, SET and CLR control the result of the logic operation without conditions. 
STL ; 
STL uses the SET operation to set the result of 
(RLO) the logic operation to signal state "1". 
SET SET starts anew operation step. 
(RLO = 1”) 
STL uses the CLR operation to reset the result 
(RLO) of the logic operation to signal state "0". 
CLR CLR starts anew operation step. 
(RLO = ”0”) 


Fig. 14.1 Setting and resetting the result of logic operation 


signal edge for enabling). In program sections with predominantly digital logic 
operations, the RLO is generally not defined, e.g. following the jump functions for 
evaluating the digital flags. Here you can use SET and CLR for defined setting or re- 
setting of the RLO or for programming a change in RLO. 


14.1.4 Controlling the binary result 
The binary result BR is controlled using the following statements or functions: 


> Control binary result with SAVE 
With SAVE you can save the result of logic operation (RLO) in the binary result 
(BR). SAVE transfers the signal state from status bit RLO to status bit BR. SAVE 


Assign binary result 


In the programming languages LAD, FBD and STL, SAVE saves the result of logic operation 
(RLO) in the binary result (BR). 
LAD 
LAD uses the SAVE coil for assignment of the 
(RLO) (RLO) result of logic operation (of the "current 
{ SAVE ) flow") to the binary result. 
FBD 
In FBD, the assignment of the result of logic 
SAVE operation to the binary result is represented 
(RLO) by the SAVE box. 
STL 
The SAVE statement saves the result of logic 
ney operation in the binary result. 
SAVE 
(RLO) 


Fig. 14.2 Assign binary result with SAVE 
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works independent of conditions and does not influence any further status bits 
(Fig. 14.2). 


> Control binary result with JCB and JNB 
The jump functions JCB and JNB with STL also influence the binary result. 
JCB sets the BR to signal state “1”, JNB to “O”. 


> Control binary result at block end 
The RET coil with LAD or the RET box with FBD save the result of logic operation 
in the binary result. 


> Influencing of binary result through program execution 
A block call with LAD and FBD influences the binary result through the program 
execution in order to control the enable output ENO (Fig. 14.3). 


s ENO connected? 

YES NO 

s EN connected? Is EN connected? 

YES NO YES NO 
sEN=“1"? Is EN =“1"? 

YES NO YES NO 

BR is set BR =“0" BR is set BR="1" BR =“0" BR is not 
corresponding corresponding affected 
to the function to the function 


Fig. 14.3 General schema for setting the binary result 


If the enable output ENO is connected, its signal state corresponds to that of the 
binary result. In certain cases (“BR is set corresponding to the function”), the exe- 
cuted function sets the binary result as follows: 


BR ‘= “1 ” 

With MOVE, with the shift functions, and with the word logic operations 
BR := OV 

With the arithmetic and math functions 

BR := OV or “1” 

With the conversion functions 

BR := BR of the called block 


With block calls 


14.1.5 Evaluating the status bits 


Evaluation with binary scans 


Fig. 14.4 shows the scan functions for the status bits with LAD, FBD, and STL. The 
combination is scanned in the case of the status bits CCO and CC1, and this delivers 
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Scan condition code bits CC0, CC1, OV, OS and BR 


In the programming languages LAD, FBD and STL, the condition code bits CCO, CC1, OS 
and BR can be scanned and the result of scan gated further. 


Scan condition code Scan condition code 
bits for "1" bits for "0" 
LAD Function Function 


—{+—-—s —_ “— 


FBD 
Function Function 
—— Oo— 

STL 

A function AN function 

° function ON function 

x function XN function 
Function: 
The scan for signal state"1" delivers the result of scan"1" with: 
>0_~—s*Result is greater than zero >=0 Result is greater than or equal to zero 
<0 ~—Result is less than zero <=0 Result is less than or equal to zero 
==0 Result is equal to zero <>0 Result is not equal to zero 
UO Result is invalid (unordered) OV_ Range overflow 
OS _ Retentive overflow BR Binary result 


Fig. 14.4 Scan status bits 


the relationships: equal to, not equal to, greater than, less than, and invalid (see al- 
so Table 14.3). A specific combination can fulfill several relationships. Example: 
The assignment of the status bits CCO = “0” and CC1 = “0” delivers the relationships 
“Equal to zero”, “Greater than or equal to zero”, and “Less than or equal to zero”. 


The overflow flags and the binary result are scanned directly. 


The scans can be executed for signal state “1” or “O”. Example with STL: If CCO = “0” 
and CC1 = “1” (with the meaning “Result is positive”), the A>0 statement delivers 
the scan result “1” and the AN >0 statement the scan result “O”. 


Evaluation with jump functions 


With the programming language STL you can evaluate the status bits RLO and BR, 
all combinations of CCO and CC1, and the status bits OV and OS with corresponding 
jump functions (Table 14.3). A detailed description of the jump functions is provid- 
ed in the next chapter. 
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Table 14.3 Evaluation of status bits with STL by scanning and with jump functions 


RLO BR | CCO CC1|]OV_~ OS | Scan function Jump function | Result is 
“yy - - - - - JC, JCB - 
“ov = - - - - - JCN, JNB - 
- 1 - - - - BR to “1 Bl - 
- “O" |= - - - BR to “O” JBIN - 
- - 0) 6) = = ==0 to “1” JZ Equal to zero 
>=0 to “1” JPZ Greater than or equal to zero 
<=0 to "1" JMZ Less than or equal to zero 
- - e) 1 - - <>0 to “1” JN Not equal to zero 
>0 to “1” JP Greater than zero 
>=0 to “1” JPZ Greater than or equal to zero 
- - 1 6) - - <>0 to “1” JN Not equal to zero 
<0 to “1” JM Less than zero 
<=0 to “1” JMZ Less than or equal to zero 
- - 1 ‘| - - UO to “1” JUO Invalid 
= = = = 1 - OV to “1” JO Overflow 
- - - - - 1 OS to “1” JOS Retentive overflow 


14.2 Jump functions 


14.2.1 Introduction 


You can use jump functions to interrupt linear execution of the program and con- 
tinue at a different position in the block. You identify this position by means of a 
jump label which you specify in the jump statement as the jump destination. 
Ajump label can consist of up to 128 letters, numbers, and underscore characters. 


The jump function and destination must be in the same block. The jump destina- 
tion or label must be unique within a block. It is permissible to jump to a destina- 
tion from more than one position. 


Both forward and backward jumps are possible with regard to the direction of pro- 
gram execution. 


Table 14.4 shows an overview of the types of jump functions. 


14.2.2 Absolute jump 


An absolute jump is carried out independent of conditions. When processing the 
jump function, program execution is continued at the specified jump label. Fig. 
14.5 shows the implementation of the jump function in the various programming 
languages. 
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Table 14.4 Types of jump functions 


Jump functions Present with 

LAD FBD STL SCL 
Absolute jump X X xX X 
Jump depending on RLO Xx Xx xX - 
Jump depending on status bits - - x - 
Jump list - - X 1) 
Loop jump - - x 1) 


1) See Chapter 10.6.3 “Control statements” on page 419 


Absolute jump 


The absolute jump is executed independent of conditions during processing. 
LAD Target If the JMP coil (jump with RLO ="1") is connected to the left 
) | busbar, the jump function is always executed during 
| ( JMP processing. 
FBD : : 7 . 
Target If the input is not connected on the JMP box (jump with 
JMP RLO ="1"), the jump function is always executed during 
processing. 
STL 3 A 2 
SPA target The SPA absolute jump is always executed during 
processing. 
SCL h é : 3 
GOTO target; The GOTO statement is always executed during processing. 


Fig. 14.5 Absolute jump independent of conditions 


Absolute jump function JMP (LAD and FBD) 


The jump functions consist of the jump statement (coil or box) and a jump label. 
The jump label identifies the entry point in the block at which program execution 
is continued when the jump function has been processed. 


The jump function JMP is connected to the left-hand power rail or does not have a 


preceding logic operation. The entry point can only be positioned at the start of a 
network. 


Absolute jump JU (STL) 


The jump function JU is always carried out, i.e. independent of any conditions. 
JU interrupts linear execution of the program and continues it at the position iden- 
tified by the jump label. The jump function JU does not influence the status bits. If 
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scan statements are present directly in front of the jump function and also at the 
jump destination, these are handled like a single logic operation. 


A jump label must always be followed by a statement. This can also be a null oper- 
ation, e.g. NOP 0: 


Label: NOP 0 //Entry with null operation 


Absolute jump GOTO (SCL) 


The jump function GOTO exits the linear program execution and continues it at a 
different position in the block. If statements form a defined block, e.g. a program 
call within a program loop, 


> the jump destination must be within this statement block if the GOTO statement 
is also within the statement block, 


> one cannot jump to this statement block “from the outside”. 


Ajump label must always be followed by a statement. A “dummy statement” is also 
permissible: 


Label: ; //Entry with “dummy statement” 


14.2.3 Conditional jump functions 


Aconditional jump is executed depending on the result of logic operation. Program 
execution is continued at the specified jump label with RLO = “1” or with RLO = “0” 
depending on the jump function. Fig. 14.6 shows the implementation of the condi- 
tional jump function in the various programming languages. 


With SCL, the dependency of the jump statement GOTO on the RLO can be emulat- 
ed, for example, by an IF statement: 


IF (* Condition *) THEN GOTO Destination; END IF; 


Conditional jump functions JMP and JMPN (LAD and FBD) 


The jump functions consist of the jump statement (coil or box) and a jump label. 
The jump label identifies the entry point in the block at which program execution 
is continued when the jump function has been processed. 


JMP branches to the entry point if the preceding logic operation is fulfilled; 
JMPN branches to the entry point if the preceding logic operation is not fulfilled. 


The jump functions terminate a current path or a logic operation. The entry point 
can only be positioned at the start of a network. 


Conditional jump functions JC and JCN (STL) 


The jump function JC is only executed if the result of logic operation is “1” when this 
function is processed. The jump is not executed if it is “O” and execution of the pro- 
gram is continued with the following statement. 
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Jump depending on result of logic operation 


The conditional jump is executed depending on the result of logic operation (RLO). 
LAD 
Target 
| ( ) The JMP jump function is executed if RLO = "1" during 
(RLO) ae processing. RLO ="0" has no effect. 
Target 
( ) The JMPN jump function is executed if RLO = "0" during 
| (RLO) IMEN processing. RLO ="1" has no effect. 
ERD Target 
JMP The JMP jump function is executed if RLO ="1" during 
processing. RLO = "0" has no effect. 
(RLO) ——— 
Target The JMPN jump function is executed if RLO = "0" during 
JMPN processing. RLO ="1" has no effect. 
(RLO) ——— 
STL i : : F qn 
(RLO) The JC conditional jump is executed with RLO ="1". 
JC target With RLO ="0", the next statement is processed. 
(RLO) The JCN conditional jump is executed with RLO = "0". 
JCN target With RLO ="1", the next statement is processed. 
(RLO) The JCB conditional jump is executed with RLO = "1". 
JCB target With RLO = "0", the next statement is processed. The RLO is 
transferred to the binary result in both cases. 
(RLO) The JNB conditional jump is executed with RLO = "0". 
JNB target With RLO ="1", the next statement is processed. The RLO is 
transferred to the binary result in both cases. 


Fig. 14.6 Conditional jump depending on result of logic operation 


The jump function JCN is only executed if the result of logic operation is “0” when 
this function is processed. The jump is not executed if it is “1” and execution of the 
program is continued with the following statement. 


JC and JCN always set the result of logic operation to “1” - even if the condition is 
not fulfilled. If the statements directly following these jump functions contain op- 
erations dependent on the result of logic operation, they are executed if the jump 
is not carried out. If this jump function is directly followed by scan statements, 
these scans are handled as first input bit scans, i.e. a new logic operation then 
starts. 


Conditional jump functions JCB and JNB (STL) 


The jump function JCB is only executed if the result of logic operation is “1” when 
this function is processed. The jump is not executed if it is “O” and execution of the 
program is continued with the following statement. 


The jump function JNB is only executed if the result of logic operation is “O” when 
this function is processed. The jump is not executed if it is “1” and execution of the 
program is continued with the following statement. 
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At the same time, JCB and JNB transfer the result of logic operation to the binary 
result - even if the condition is not fulfilled. JCB and JNB then always set the result 
of logic operation to “1” - even if the condition is not fulfilled. If the statements di- 
rectly following this jump function contain operations dependent on the result of 
logic operation, they are executed if the jump is not carried out. If this jump func- 
tion is directly followed by scan statements, these scans are handled as first input 
bit scans, i.e. a new logic operation then starts. 


14.2.4 Jump functions depending on status bits 


STL provides jump functions with which the assignment of the status bits (BR, CCO, 
CC1, OV, OS) can be evaluated. An overview of the combinations which can be 
scanned and the jump functions is provided in Table 14.3 on Page 568. 


Scanning of the status bits is possible in LAD and FBD, and it is possible to program 
a conditional jump function JMP or JMPN dependent on these (see Chapter 14.1.5 
“Evaluating the status bits” on page 566). 


Jump functions JBI and JBIN dependent on binary result (STL) 


The jump function JBI is only executed if the binary result is “1” when this function 
is processed. The jump is not executed if the binary result is “O” and execution of 
the program is continued with the following statement. 


The jump function JBIN is only executed if the binary result is “O” when this func- 
tion is processed. The jump is not executed if the binary result is “1” and execution 
of the program is continued with the following statement. 


JBI and JBIN terminate a binary logic operation; a new logic operation starts follow- 
ing the jump function or at the jump destination. The RLO is retained and can be 
evaluated using a memory function following the jump function. 


Jump functions JZ, JN, JP, JPZ, JM, JMZ, and JUO (STL) 


The jump functions dependent on the status bits CCO and CC1 do not change any 
status bits. The result of logic operation is “carried over” with the jump and can be 
linked further (no change in /FC). 


The jump function JZ is only executed if the status bits are CCO = “0” and CC1 = “0”. 
This is the case if: 


The content of accumulator 1 is zero following an arithmetic or math function 


The content of accumulator 2 is equal to the content of accumulator 1 with a 
comparison function 


The content of accumulator 1 is zero following a word logic operation 


The value of the last shifted-out bit is “O” following a shift function 
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The jump function JN is only executed if the status bits CCO and CC1 have different 
signal states. This is the case if: 


The content of accumulator 1 is not zero following an arithmetic or math 
function 


The content of accumulator 2 is not equal to the content of accumulator 1 with 
a comparison function 


The content of accumulator 1 is not zero following a word logic operation 


The value of the last shifted-out bit is “1” following a shift function 


The jump function JP is only executed if the status bits are CCO = “0” and CC1 = “1”. 
This is the case if: 


> 


> 


> 


The content of accumulator 1 is within the permissible positive numerical range 
following an arithmetic or math function (you scan for violation of the numeri- 
cal range using JO or JOS) 


The content of accumulator 2 is greater than the content of accumulator 1 with 
a comparison function 


The content of accumulator 1 is not zero following a word logic operation 


The value of the last shifted-out bit is “1” following a shift function 


The jump function JPZ is only executed if the status bit CCO = “O”. This is the case if: 


The content of accumulator 1 is within the permissible positive numerical range 
or zero following an arithmetic or math function (you scan for violation of the 
numerical range using JO or JOS) 


The content of accumulator 2 is greater than or equal to the content of accumu- 
lator 1 with a comparison function 


Following every word logic operation 


Following every shift function 


The jump function JM is only executed if the status bits are CCO = “1” and CC1 = “0”. 
This is the case if: 


> 


The content of accumulator 1 is within the permissible negative numerical range 
following an arithmetic or math function (you scan for violation of the numeri- 
cal range using JO or JOS) 


The content of accumulator 2 is less than the content of accumulator 1 witha 
comparison function 


The jump function JMZ is only executed if the status bit CC1 = “0”. This is the case if: 


> 


> 


The content of accumulator 1 is within the permissible negative numerical range 
or zero following an arithmetic or math function (you scan for violation of the 
numerical range using JO or JOS) 


The content of accumulator 2 is less than or equal to the content of 
accumulator 1 with a comparison function 
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The jump function JUO is only executed if the status bits are CCO = “1” and CC1 = 
“1”. This is the case if: 


> Division is by zero with an arithmetic function 


> Aninvalid REAL number has been specified as input value or is produced as 
result 


Jump functions JO and JOS (STL) 


A program branch can be executed depending on the status bits OV and OS. In this 
case you scan whether the result of a calculation is still within the permissible 
numerical range. 


The jump function JO (jump if overflow) is only executed if the status bit OV is set 
to “1”. This is the case if the permissible numerical range has been left following 
execution of an operation. The following functions can set the status bit OV: 


Arithmetic functions 
Math functions 
Generation of two's complement 


Comparison functions with REAL numbers 


Conversion functions INT or DINT to BCD and REAL to DINT 


If the status bit OV = “0”, JO continues execution of the program with the next state- 
ment. 


In the case of a chain calculation with several operations executed in succession, the 
status bit OV must be executed following each calculation function since the next 
calculation whose result is in the permissible numerical range resets OV again. 
Scan the status bit OS in order to evaluate a possible numerical range overflow at 
the end of the chain calculation. 


The jump function JOS (jump if overflow stored) is only executed if the status bit OS 
is set to “1”. This is always the case is a numerical range overflow sets the status bit 
OV (see above). In contrast to OV, OS remains set if the result is subsequently in the 
permissible numerical range. 


The following functions reset OS again: 


> Block call and block end 


> Jump if stored overflow JOS 


If the status bit OS = “0”, JOS continues execution of the program with the next 
statement. 
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14.3 Block end functions 


A block end function prematurely terminates the processing in a block. A return is 
made to the previously processed block in which the call of the block just terminat- 
ed is present. If an organization block is terminated, a branch is made to the oper- 
ating system. 


Fig. 14.7 shows the representation of the block end functions in the various pro- 
gramming languages. 


Block end functions 


Processing in the current block is terminated by the block end functions, and continued in the calling 
block. If an organization block is terminated, processing is continued in the CPU's operating system. 


ue RLO The RET coil is present alone in anetwork as termination of a 


— RET 4 preceding logic operation. The block is left if the preceding 
logic operation is fulfilled. 


The RET coil saves the RLO in the binary result. 


re RLO The RET box is present alone in a network as termination of a 
RET preceding logic operation. The block is left if the preceding 
logic operation is fulfilled. 


The RET box saves the RLO in the binary result. 


STL BEC terminates block processing when RLO ="1". 

BEC //Conditional block end BEU and BE terminate block processing independent of 
BEU //Unconditional block end conditions. BEis the last statementin a block, and can also be 
BE //Block end omitted. 

SCL RETURN terminates block processing independent of 
RETURN; //Block end conditions. 


Fig. 14.7 Block end functions 


14.3.1 Block end function RET (LAD and FBD) 


You can use the block end function RET to prematurely terminate processing in a 
block depending on the result of logic operation. The block end function is repre- 
sented as an RET coil or RET box which requires a preceding logic operation. The 
block is left if the preceding logic operation is fulfilled, or processing is continued 
in the next network if the preceding logic operation is not fulfilled. The RET coil/box 
must only terminate a current path or logic operation on its own. 


The RET coil/box simultaneously saves the result of logic operation in the binary re- 
sult BR, irrespective of whether the preceding logic operation was fulfilled or not. 
The binary result is decisive for controlling the enable output ENO on the call box. 
If a block is left prematurely with the RET coil/box, the enable output ENO of the call 
is always occupied by signal state “1”. If the RET coil/box is the last statement in the 
block, the RLO currently present when the block is left is transferred to the enable 
output ENO. 
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14.3.2 Block end functions BEC, BEU, and BE (STL) 


Execution of BEC depends on the result of logic operation (RLO). If the RLO is “1” 
upon execution of BEC, the statement is executed and the block is terminated. A re- 
turn is made to the previously executed block in which the block call was present. If 
the RLO is “O” upon execution of the BEC statement, the statement is not executed. 
The control processor sets the RLO to “1” and processes the statement following 
BEC. A subsequently programmed scan statement is always a first input bit scan. 


The block is left upon processing of BEU. A return is made to the previously execut- 
ed block in which the block call was present. In contrast to the BE statement, you can 
program BEU repeatedly within a block. The program section following BEU is only 
processed if it is jumped to by means of a jump function. 


The block is terminated upon processing of BE. A return is made to the previously 
executed block in which the block call was present. BE is always the last statement 
of a block. Programming of BE is optional. 


14.3.3. RETURN statement (SCL) 
RETURN leaves the currently processed block without conditions. 


RETURN transfers the signal state of the ENO tag to the enable output ENO of the 
left block. Programming of RETURN at the end of the block is optional. 


14.4 Calling of code blocks 


14.4.1 General information on block calls 
If a function block (FB) or a function (FC) is to be processed, it must be “called”. 


With LAD and FBD, the block call consists of the call box which contains the address 
or name of the called block, the enable input EN, the enable output ENO, and the 
parameter list. With STL and SCL, the address or name of the block is specified in 
the call operation, followed by the parameter list. 


Following processing of the call function, the CPU continues program execution in 
the called block. The block is processed up to a block end function or up to its end. 
The CPU then returns to the calling block and continues processing of this block 
after the call function. 


An organization block (OB) cannot be called; it is started by the operating system 
depending on events. If an organization block is terminated, the CPU continues to 
work in the operating system. 


The block parameters are the data interface to the called block. You should avoid 
data transfer using internal registers (e.g. accumulators, address registers, RLO) 
since the contents of these registers can be changed when changing the block (by 
“hidden” statements sent by the program editor). You - and also the program editor 
- can only use the binary result BR in order to control the enable output ENO of the 
call function. 
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Chapter 5.2 “Creating a user program” on page 151 describes the available blocks 
and block parameters, what has to be observed with a call (for example the nesting 
depth), and how the blocks and block parameters are programmed. 


The calls of code blocks are represented by the block call box in the case of LAD and 
FBD, by the CALL statement in the case of STL, and by the block name in the case of 
SCL. Functions for changing to another block without parameters are additionally 
possible with LAD, FBD, and STL for special applications. 


14.4.2 Calling a function (FC) 


The calls of a function (FC) and a system function (SFC) are handled in the same 
manner. Fig. 14.8 shows the block call for a function and for a system function. All 
block parameters must be supplied with actual parameters. 


FC and SFC calls with LAD and FBD 


You use the call box with LAD and FBD to call a function or a system function. You 
can use the enable input EN to structure the block call depending on the result of 
logic operation. If the EN input leads directly to the left-hand power rail or if it is not 
connected, the call is an absolute call and is always executed. If the EN input has a 
preceding logic operation, the block call is only executed if the latter is fulfilled. 


FC and SFC calls with STL 


You use the CALL operation with STL to call a function or a system function. CALL 
is an absolute call, i.e. the specified block is always called and processed indepen- 
dent of conditions. 


Note that the CALL statement can change the contents of the data block registers DB 
and DI, the contents of the address registers AR1 and AR2, and the contents of the 
accumulators 1 and 2. The status bits /FC, OS, and OR are set to “O”. 


FC and SFC calls with SCL 


You call a function (FC) or a system function (SFC) which does not have a function 
value using its absolute address or its name. This is followed by the parameter list 
in round brackets. You must assign values to all existing parameters; the parameter 
sequence is defined by the declaration. 


The call of a function (FC) or system function (SFC) with function value must be 
handled in the SCL program like a tag which has the data type of the function value. 
The call function is then present in the assignment or expression instead of the 
function value. The call function consists of the absolute address or the name of the 
block followed by the parameter list in round brackets. The parameter sequence is 
defined by the declaration. All parameters must be supplied with values. 


The implicitly defined enable input EN cannot be used with a function with function 
value since the output parameters may have an undefined assignment under cer- 
tain circumstances if EN is FALSE. 
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If you wish to use the implicitly defined enable output ENO, add it to the parameter 
list as the last parameter. 


Calling a function (FC) or a system function (SFC) 


A function FC represents a program section (a block) without own data. A system function SFC 
is an FCblock whose program code is present in the operating system and whose call is present in 
the user program. 
A function (FC) has a function value (return value) with the preset name RET_VAL. This name can be 
changed, however. This function value can be "deactivated" for the interface declaration if it is occupied 
with the data type VOID. Any other data type "activates" the function value. 
All block parameters must be supplied with actual parameters when called. 
LAD 
FC nam An FC or SFC block is called in LAD by an EN/ENO box. 
£ Theinput and in/out parameters are present on the 
—EN ENO — left-hand side of the call box in the order of their declaration, 
and the output parameters on the right-hand side. If the 
—nameT — RET_VAL —— function value is "activated", it is represented as the first 
—i name3 — output parameter. 
— name2 —— 
FBD , . 
FC name An FC or SFC block is called in FBD by an EN/ENO box. 
Theinput and in/out parameters are present on the 
— EN left-hand side of the call box in the order of their declaration, 
—omen RET VAL — and the output parameters on the right-hand side. If the 
> function value is "activated", it is represented as the first 
"Ee name3 — output parameter. 
— name2 —— 
—_—re ENO — 
STL " " . . . 
Call "FC name An FC or SFC block is called in STL by the CALL operation. 
Ini i= .. The next lines contain the parameter list. The parameters 
In2 := .. are specified in the order of their declaration. 
Bae a > If the function value is "activated", it is represented as the 
first output parameter. 
Call "FC name" 
Inl f= an 
In2 ae 
RET VAL := ... 
Outl se 
Out2 t= 
SCL " " : . . ae 
FC name" ( An FC or SFC block is called in SCL by its name. This is 
Int i= followed by the parameter list in parentheses. 
In2 i=. Theparameters are specified in the order of their 
Outl =>. , declaration, each separated by acomma. 
ac If the function value is "activated", the block call responds 
a a like a tag with the value and the data type of the function 
#Tag := "FC name" ( : 
inl 2 value. It can then be assigned to a tag, for example, or used 
i Peet in an expression. 
n2 tS y 
Outl SPP ae iF 
Out2 =>. )7 


Fig. 14.8 Call functions for a function (FC) and a system function (SFC) 
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14.4.3 Calling a function block (FB) 


The calls of a function block (FB) and a system function block (SFB) are handled in 
the same manner. Both block types can be called as single instance or local instance. 
Fig. 14.9 shows the block call for a function block as single instance and as local 
instance. 


With function blocks, not all block parameters have to be supplied during the call. 
In/out parameters with complex data type and block parameters with parameter 
type should be assigned default values with the correct syntax or at least written 
during the first call. Writing of the other block parameters is optional. 


FB and SFB calls with LAD and FBD 


You use the call box with LAD and FBD to call a function block or a system function 
block. You can use the enable input EN to structure the block call depending on the 
result of logic operation. If the EN input leads directly to the left-hand power rail or 
if it is not connected, the call is an absolute call and is always executed. If the EN 
input has a preceding logic operation, the block call is only executed if the latter is 
fulfilled. 


CALL statement with STL 


You use the CALL operation with STL to call a function block or a system function 
block. CALL is an absolute call, i.e. the specified block is always called and processed 
independent of conditions. When called as single instance, the block name is fol- 
lowed by the name of the instance data block, separated by a dot. Specify the in- 
stance name when calling as local instance. Only specify the block parameters in 
the parameter list which you supply. 


Note that the CALL statement can change the contents of the data block registers DB 
and DI, the contents of the address registers AR1 and AR2, and the contents of the 
accumulators 1 and 2. The status bits /FC, OS, and OR are set to “O”. 


FB and SFB calls with SCL 


With SCL you call a function block or a system function block as single instance with 
the block name and the instance data block or as local instance with the instance 
name. You specify the name of the instance data block when calling as a single in- 
stance. Specify the instance name when calling as local instance. Only specify the 
block parameters in the parameter list which you supply. 


If you wish to use the implicitly defined enable input EN, add it to the parameter list 
as the first parameter. 


If you wish to use the implicitly defined enable output ENO, add it to the parameter 
list as the last parameter. 
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Call of a function block (FB) and a system function block (SFB) 


instance". 


A function block FB represents a program section (a block) with its own data which is present in 
an instance data block. Asystem function block (SFB) is a function block whose program code is present 
in the operating system and whose call and instance data are present in the user program. 


If the instance data is in a separate data block, one refers to a"single instance". If the instance data is in the 
instance data block of the calling function block (if this is a "multi-instance"), one refers to a "local 


In/out parameters with compound data type and block parameters with parameter type should be 
assigned default values with the correct syntax or at least written during the first call. Writing of the other 
block parameters is optional. 


— EN 


— name 


Instance data 
FB name 


ENO — 
name3 —— 


— name2 


An FB or SFB blockis called in LAD by the EN/ENO box. The input 
and in/out parameters are present on the left-hand side of the 
call box and the output parameters on the right side, in the 
order of their declaration in each case. 


The name of the call instance is shown above the call box. In the 
case of a single instance, this is the instance data block. In the 
case of a local instance, this is the instance name in the static 
local data of the calling function block. 


FBD 


Instance data 
FB name 


An FB or SFB block is called in FBD by the EN/ENO box. The input 
and in/out parameters are present on the left-hand side of the 
call box and the output parameters on the right side, in the 
order of their declaration in each case. 


The name of the call instance is shown above the call box. In the 
case of a single instance, this is the instance data block. In the 
case of a local instance, this is the instance name in the static 
local data of the calling function block. 


STL 


CALL " 
Inl 
In2 
Outl 
Out2 


CALL 
Inl 
In2 
Outl 
Out2 


FB name","DB name" 


#Instance_ name 


iT 


The block name is specified when calling as a single instance, 
followed by acomma and the name of the instance data block. 
The instance name is specified when calling asa localinstance. 

The next lines contain the list of block parameters, in each case 


in the order of their declaration. Only the block parameters 
need be listed which are written. 


SCL 


Inl 
In2 
Outl 
Out2 


Inl 
In2 
Outl 
Out2 


"DB name" ( 


SS. % 
SP ee 


#Instance_name ( 


r= 
Sait 5 
Se LF 


The name of the instance data block is specified when calling 
as a single instance. 
The instance name is specified when calling as alocal instance. 


This is followed by the list of block parameters in parentheses, 
in each case in the order of their declaration and separated by a 
comma. Only the block parameters need be listed which are 
written. 


Fig. 14.9 Call functions for a function block (FB) and a system function block (SFB) 
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14.4.4 Change to a block without block parameter 


Program execution can be continued in another block by using the functions for 
block change (not to be confused with the functions for block call). This block 
change is carried out without the program extension required for supplying the 
block parameters and for saving the register contents. Therefore the block selected 
by the change cannot and must not have any block parameters. Use of these func- 
tions is therefore limited to special applications (Fig. 14.10). 


Change to a block without parameter 


When executing the CALL function (with LAD and FBD) or the UC and CC operations (with STL), 
the program execution changes to the specified block. This block must not have any block parameters or 
with function blocks an instance data block, and thus no static local data. 


LAD " 0 
Block name The CALL coil initiates the change to the block whose name is 
— CALL} present above the coil. The change is carried out depending on a 
fulfilled preceding logic operation. 
FED "Block name" The CALL box initiates the change to the block whose name is 
CALL present above the coil. The change is carried out depending on a 
fulfilled preceding logic operation. 
STL 7 
uc "Block name" The UC operation initiates the change to the specified block 
independent of conditions. 
CC "Block name" The CC operation initiates the change to the specified block 


depending on the result of logic operation. 


Fig. 14.10 Change to a block without parameters with LAD, FBD, and STL 


The functions for block change are present in LAD, FBD, and STL. They have the fol- 
lowing properties: 


> Influencing of condition codes 


The status bit OS is reset when changing the block, the status bits CCO, CC1, and 
OV are not influenced. The status bit /FC is reset, i.e. a new logic operation starts 
with the first scan statement in the new block and following the block change 
statement. 


> Settings of the master control relay 


The MCR dependency is deactivated upon a block change. The MCR is deactivated 
in the new block independent of whether it was activated or deactivated prior to 
the block change. When the block is left, the MCR dependency is reset to its state 
prior to the block change. 


> Assignment of data block registers 


The change to a block saves the data block registers. Following completion of 
block processing, their contents are restored. The global and instance data 
blocks present prior to the block change are also open following the change. If 
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no data block was open prior to the block change (i.e. no instance data block in 
OB 1), no data block is open following the change either, irrespective of the data 
blocks open in the new block. 


> Assignment of accumulators and address registers (STL) 


The contents of accumulators and address registers are not changed upon a 
block change with UC or CC. 


> Response of binary nesting stack (STL) 


You can also change to a code block within a binary nesting expression. The cur- 
rent stack depth of the binary nesting stack is not changed upon a block change. 
The possible nesting stack depth in a block which is changed to within binary 
nesting is therefore the difference between the maximum possible nesting depth 
and the current nesting depth when changing the block. 


Block change with LAD 


With LAD, you use the CALL coil for a block change. If the CALL coil is connected di- 
rectly to the left-hand power rail or if the preceding logic operation is fulfilled, a 
change is made to the block named above the CALL coil. Only one CALL coil is per- 
missible per network. 


You can use the CALL coil to change to a function (FC) or system function (SFC) that 
has no block parameters. You can also specify a block parameter of type BLOCK_FC 
as the operand on the CALL coil. 


Block change with FBD 


With FBD, you use the CALL box for a block change. If the CALL box does not have a 
preceding logic operation or if an existing preceding logic operation is fulfilled, 
a change is made to the block named above the CALL box. Only one single CALL box 
is permissible per network. 


You can use the CALL box to change to a function (FC) or system function (SFC) that 
has no block parameters. You can also specify a block parameter of type BLOCK_FC 
as the operand on the CALL box. 


Block change with STL 


With STL, you use the UC operation for an absolute block change and the CC oper- 
ation for a block change depending on the result of logic operation. The RLO is set 
to “1” if CC is processed with RLO = “O”, and the statement following CC is pro- 
cessed. 


All blocks which can be called and which do not have their own parameters are per- 
missible as operands for UC and CC. 


You can also change to a block present as block parameter of type BLOCK _FC or 
BLOCK_FB. Memory-indirect addressing of the blocks is possible when changing 
using the UC and CC operations. 
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14.5 Data block functions 


The data tags are saved in the data blocks. In order to access the data tags, a data 
block must first be “opened” (selected). During complete addressing with specifica- 
tion of the data block, the program editor generates the corresponding statement 
which is not visible to you as the user. During partial addressing where you only 
specify the data tag, you must ensure that the “correct” data block has first been 
opened. 


Opening of a data block by the user is possible with LAD, FBD, and STL. SCL only 
supports complete addressing of data tags and can therefore relinquish statements 
for manipulation of data block registers by the user. 


Every CPU 400 has two data block registers. These registers contain the numbers of 
the current data blocks. These are the data blocks whose operands are currently be- 
ing used for processing. The program editor preferably uses the first data block reg- 
ister for access to global data blocks, and the second data block register for access 
to instance data blocks. Therefore these registers are also named “Global data block 
registers” (abbreviated to: DB registers) and “Instance data block registers” (abbre- 
viated to: DI registers). 


Handling of the registers by the CPU is absolutely equivalent. Each data block can 
be opened by one of the two registers (also by both simultaneously). Data operands 
present in a data block opened using the DB register can be addressed - partially 
addressed - using “DB”, for example %DBW2. Data operands present in a data block 
opened using the DI register can be addressed using “DI”, for example %DIW2. 


An opened data block remains “valid” until another data block is opened. This may 
take place using the program editor and is not visible to you as the user. This results 
in limitations in partial addressing of data tags. For more details on data address- 
ing, refer to Chapter 4.2.2 “Absolute addressing of tags” on page 96. 


You can also generate data blocks during runtime and thus flexibly adapt the mem- 
ory space for data to the data volume. It is additionally possible to save data blocks 
only in the load memory, which can be designed much larger than the work 
memory. 


This is preferentially carried out for data which is used infrequently in the program, 
for example for recipes or archives, since access operations to the load memory 
require a very long time and the number of write operations is physically limited. 


14.5.1 Opening a data block 


Opening of a data block is carried out independent of any conditions. It does not in- 
fluence the result of logic operation or the accumulator contents; the nesting depth 
of the block calls is not changed. 


The opened data block must be present in the work memory. The data block can be 
addressed absolutely or symbolically. 
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Open data block 


Opening of a data block is required in order to address data operands. In the case of "complete 
addressing", the program editor is responsible for opening the data block by means of corresponding 
instructions "in the background". If one uses the "partial addressing" possible with the programming 
languages LAD, FBD and STL, one must open the "correct" data block oneself. 
LAD 
"Data block" 
) | The OPN coil opens the data block via the DB register. 
DEN It does not have a preceding logic operation. 
"Data block" 
) | The OPNI coil opens the data block via the DI register. 
Orn It does not have a preceding logic operation. 
EBD "Data block" 
OPN The OPN box opens the data block via the DB register. 
It does not have a preceding logic operation. 
"Data block" 
OPNI The OPNI box opens the data block via the DI register. 
It does not have a preceding logic operation. 
STL 
OPN "Data block" The OPN operation opens the data block via the 
DB register. 
OPNDI "Data block" The OPNDI operation opens the data block via the 
DI register. 


Fig. 14.11 Opening a data block 


Fig. 14.11 shows the functions for opening a data block. A block parameter with pa- 
rameter type BLOCK_DB can also be used instead of “Data block”. 


14.5.2 Additional data block functions with STL 


Swapping data block registers CDB 


The CDB statement exchanges the contents of the data block registers. It is executed 
independent of conditions and influences neither the status bits nor the other 
registers. 


CDB //Exchange contents of data block registers 


Loading data block length (L DBLG and L DILG) 


The L DBLG statement loads the length of the data block which has been opened via 
the DB register into accumulator 1. The L DILG statement loads the length of the 
data block which has been opened via the DI register into accumulator 1. The length 
is equivalent to the number of data bytes. 


L  DBLG //Load length of data block in DB register 
L  DILG //Load length of data block in DI register 
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These load statements transfer the previous contents of accumulator 1 into 
accumulator 2 in accordance with a “normal” load function. If a data block has not 
been opened via the associated register, zero is loaded as the length. 


Loading data block number (L DBNO and L DINO) 


The L DBNO statement loads the number of the data block which has been opened 
via the DB register into accumulator 1. The L DINO statement loads the number of 
the data block which has been opened via the DI register into accumulator 1. 


L = DBNO //Load number of data block in DB register 
L DINO //Load number of data block in DI register 


These load statements transfer the previous contents of accumulator 1 into 
accumulator 2 in accordance with a “normal” load function. If a data block has not 
been opened via the associated register, zero is loaded as the number. 


Example: 
L DBNO If the data block %DB10 has been opened via the DB register, 
i i processing should continue at the jump label Data10. 
== 
JC Datal0 


Direct writing back of the number into a data block register is not possible; you can 
only influence the data block register using OPN or OPNDI (open data block) 
and CDB (exchange data block register). 


14.5.3 Creating, deleting, and testing data blocks 


The following system blocks are available for generating, deleting, and testing 
a data block and are represented graphically in Fig. 14.12. 


System functions for data blocks 


SFC 22 SFC 23 SFC 24 
Create data block in Delete data block Test data block 
working memory 
CREAT_DB DEL_DB TEST_DB 
— LOW _LIMIT RET _VAL—  — DB_NUMBER- RET_VAL——- —— DB_NUMBER_ RET_VAL —— 
— UP_LIMIT DB NUMBER —— DB_LENGTH —— 
— COUNT WRITE_PROT —— 


Fig. 14.12 Graphic representation of system functions for data blocks 


> CREAT DB Create data block in work memory (SFC 22) 
> DEL _DB Delete data block (SFC 23) 
> TEST_DB Test data block (SFC 24) 
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Data blocks in the user memory 


A data block is normally present twice in the user memory of a CPU: once in the 
load memory and - the part relevant to execution - in the work memory. If the 
Only store in load memory attribute is activated, the data block is only in the load 
memory (Fig. 14.13). 


Data blocks in the user memory 


Load memory Work memory 
%DB11 Adata block generated using the programming device 
and with the Only store in load memory attribute 
Not execution- deactivated is present twice in the CPU's user memory. 
relevant %DB11 It is completely present in the load memory. 
; , The"execution-relevant" data is present in the work 
Exoccisteln Beceiiten memory, i.e. the data with which the user program 
relevant data relevant data 
works. 
%DB12 ; ; ; 
5 A data block generated using the programming device 
Not execution- and with the Only store in load memory attribute 
relevant activated is only present in the CPU's load memory. 
; This data block does not occupy any space in the work 
Execution- memory. 
relevant data 7 
%DB13 
E , CREAT_DB generates a data block which is only 
xecution- 4 h ie 
wdavemni Gea present in the work memory. 


Fig. 14.13 Data blocks in the user memory 


CREAT _DB Create data block in the work memory 


CREAT_DB generates a data block in the work memory. For the number of the data 
block, the system blocks use the lowest free number in the number range which is 
specified by the input parameters LOW_LIMIT and UP_LIMIT. The numbers speci- 
fied at these parameters are included in the number range. If the two values are the 
same, the data block is created with exactly this number. The number of a data 
block already included in the user program cannot be assigned again, not even if 
the data block is only present in the load memory. 


The output parameter DB_NUMBER delivers the number of the actually created data 
block. The input parameter COUNT is used to specify the length of the data block to 
be created. The length corresponds to the number of data bytes and must be an 
even number. 


The associated data block is not called when it is created. The current data block is 
still valid. Random data is present in a data block created using CREAT_DB. To use 
itmeaningfully, it is first necessary to write into a data block created in this manner 
before data is read. 


A data block created using the CREAT_DB function is only present in the work mem- 
ory. 
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A data block is not created in the event of an error. The DB_ NUMBER parameter is 
then occupied by zero and an error number is output via RET_VAL. 


DEL_DB Delete data block 


DEL_DB deletes the data block in the work and (RAM) load memories whose number 
is specified in the input parameter DB_NUMBER. If the Only store in load memory at- 
tribute is activated at the data block, it cannot be deleted. If the data block is ona 
FLASH memory card, it will be declared invalid and is then practically no longer 
available for the user program. After a cold restart or an unbuffered POWER ON, the 
data block is imported from the load memory into the work memory and is then 
available again. 


If the data block is currently being called or if it has been called “further up” in the 
call hierarchy, a CPU 400 calls the organization block OB 121 Programming error. If 
OB 121 is not present, the CPU switches to STOP mode. 


TEST_DB Test data block 


TEST_DB delivers information on a data block whose number you specify in the in- 
put parameter DB_ NUMBER. The number of existing bytes is present in the output 
parameter DB_LENGTH and the output parameter WRITE PROT indicates whether 
the data block is read-only. 


If the tested data block is only in the load memory, this is signaled as an error via 
RET_VAL; the DB_LENGTH and WRITE_PROT parameters are nevertheless occupied 
correctly. 


If the specified data block is not in the CPU's user memory, RET_VAL = W#16#80B1 
is returned. 


14.6 Master control relay 


14.6.1 Introduction 


In the case of conventional controls, a master control relay activates or deactivates 
part of the controller which may consist of one or more current paths. A deactivated 
current path switches off all non-retentive contactors and retains the status of 
retentive contactors. You can only change the status of the contactors again when 
the master control relay (MCR) is activated. 


Note that switching-off with the “software” master control relay does not replace the 
emergency stop or safety equipment! Consider switching with the master control relay 
to be the same as switching with a memory function! 


The corresponding statements are available in the programming languages LAD, 
FBD, and STL for implementation of the master control relay. SCL does not use 
statements for the MCR function. 


Despite the MCR dependency being switched on, you can use the system blocks SET, 
RESET, SETI, RESETI, SETP, and RESETP to set or reset the bits of an I/O or memory 
area (see Chapter 13.2 “Transfer functions” on page 508). 
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14.6.2 MCR dependency 


The master control relay (MCR) acts on all operations which write a value back into 
the memory. Fig. 14.14 lists these MCR-dependent operations. 


MCR-dependent operations 


In the following operations, the tag is set to signal state "0" if the Master Control 
Relay (MCR) is activated: 


LAD FBD STL 
Tag 
Assign tag Tag = = tag 
Te 
Assign tag is 
in a logic operation = = tag 


a ee ae 


In the following operations, the tag is no longer controlled (the signal state is "frozen") 
if the Master Control Relay (MCR) is activated: 


Tag 
Tag 5 S tag 
Set tag ( | 
s 
Tag 
Tag R R tag 
Reset tag f } 
R 
Tag Tag 
i SR SR = 
Dominant z S tag 
reset $ Q os 
—— Rl —— RI Q— Rtag 
Tag Tag 
: RS RS os 
Dominant R tag 
set R Q R a 
—S1 ——S1 Q— S&S tag 


In the following operations, a value of 0 (zero) is transferred to the (output) tag if the 
Master Control Relay (MCR) is activated: 


T tag 


Transfer — = 
——_ ouUT——-  ——... ouT —— 


—_E2 Oul—_- ——E OUT ——— 


(concerns all digital outputs of a box) 


Fig. 14.14 Functions dependent on the MCR 
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Some program functions use transfer statements — not visible to you as the user - 
e.g. to write a value into a memory area. Since the transfer statement writes a value 
of zero with MCR dependency activated, the corresponding program function is 
then no longer guaranteed. 


You must exclude the following program sections from MCR dependency, otherwise 
the CPU will switch to STOP or can have an undefined runtime response: 


> Block calls with block parameters 
> Access to block parameters which are parameter types (e.g. BLOCK_DB) 


> Access to block parameters which are components of complex data types or 
PLC data types 


If the MCR dependency is deactivated, the MCR-dependent operations respond 
“normally” as described in the corresponding chapters. 


14.6.3 MCR area and MCR zone 


In order to use the properties of the master control relay, define an MCR area using 
the Activate MCR area and Deactivate MCR area statements. The MCR dependency is 
activated within an MCR area - but not yet switched on. 


In order to switch on MCR dependency, define an MCR zone using the Open MCR 
zone and Close MCR zone statements. If Open MCR zone is processed with result of 
logic operation “0”, the MCR dependency is switched on within the MCR zone 
(analogous to switching off the master control relay). If Open MCR zone is processed 
with RLO = “1”, MCR dependency is switched off and the statements in the MCR zone 
respond “normally” again (Fig. 14.15). 


MCR zones can be nested: You can open an MCR zone up to eight times before hav- 
ing to close an MCR zone again. The MCR dependency of an “outer” MCR zone 
switches on the MCR dependency of all nested MCR zones. If the MCR dependency 
is switched off in an “outer” MCR zone, you can switch on the MCR dependency in 
the “inner” MCR zone (and in all further nested MCR zones). 


14.6.4 MCR area and MCR zone with a block change 


If you call a block within an MCR area, MCR dependency is deactivated in the called 
block. An MCR area only begins again with the Activate MCR area statement. When 
leaving a block, MCR dependency is set as it was prior to the block call, independent 
of the MCR dependency with which the called block was left. 


A block call within an MCR zone does not change the nesting depth of an MCR zone. 
The program in the called block is still present in the MCR zone which was open 
during the block call and is controlled by this. However, you must activate the MCR 
dependency again in a called block by opening the MCR area. 
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Master Control Relay MCR 


The Master Control Relay (MCR) controls the write operations in the user memory. You can activate the 
Master Control Relay within an MCR areaand control the MCR dependency within an MCR zone. 


Block 
Activate MCR area <@m You can use the Activate MCR area instruction to open 
an MCR area. You can define MCR zones within this 
MCR area area. 
Open MCR zone <@™ You can use the Open MCR zone instruction to define 
MCR zone the start of an MCR zone. Within this zone, you can use 
RLO="0"0n the Open MCR zone instruction to switch on 
the MCR dependency and RLO ="1" to switch it off again. 
Close MCR zone <@™ You canuse the Close MCR zone instruction to terminate 
an MCR zone. 
Deactivate MCR area <@m You can use the Deactivate MCR area instruction to 
close an MCR area. 
End of block 


MCR zones can be nested: You can open and close a further MCR zone within an MCR zone. You can nest 
up to eight MCR zones. The "outer" MCR zone in each case switches on the MCR dependency of all nested 
MCR zones. If the MCR dependency is switched off in the "outer" MCR zone, you can switch on the MCR 
dependency in the "inner" MCR zone. 


Block 


Activate MCR area 


MCR area 
Open MCR zone <@m = Youcanuse the Open MCR zone instruction of an "outer" 
MCR 1 MCR zone to switch on the MCR dependency of all 
Buus nested MCR zones. 


Open MCR zone <@_ Youcan use the Open MCR zone instruction of an"inner" 
MCR zone to switch on the MCR dependency in this 
nested MCR zone, even if the MCR dependency in the 


"outer" MCR zone is switched off. 


Close MCR zone 


Open MCR zone <@—m = You can open and close any number of MCR zones in 
MCR zone succession. This does not affect the nesting depth. 


Close MCR zone 


Deactivate MCR area 
End of block 


Fig. 14.15 Nesting of MCR area and MCR zones 
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14.6.5 Statements for the master control relay 


The statements shown in Fig. 14.16 are available in the programming languages 
LAD, FBD, and STL for implementation of the master control relay (MCR). 


Statements for the Master Control Relay MCR 


The following statements are available for implementation of the Master Control Relay: 


LAD FBD STL 


MCRA MCRA 


Activate MCR area {cra} 


0 MCR MCR< MCR ( 
pen zone (M cr) | 
MCR> MCR 
Close MCR zone (mcr>} ) 
MCRD 


Deactivate MCR area {cro} vou 


Fig. 14.16 Master control relay, statements in LAD, FBD, and STL 


Descriptions of how the master control relay is programmed in the various lan- 
guages can be found for LAD in Chapter 7.6.5 “Master Control Relay (MCR)” on page 
313, for FBD in Chapter 8.6.5 “Master Control Relay (MCR)” on page 346, and for STL 
in Chapter 9.6.7 “Master Control Relay (MCR)” on page 389. 
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15 Online operation and program test 


One refers to online operation or online mode if a programming device is connect- 
ed to a PLC or HMI station and an online connection has been established. An online 
connection is required in order to upload the user program to the CPU, to test it in 
the CPU during runtime, or to find hardware faults using diagnostic functions. 


The mechanical connection - the cabling - depends on the configuration of the pro- 
gramming device and CPU. Every CPU has an MPI (multi-point interface). CPUs with 
“DP” in the short designation have at least one PROFIBUS interface, where an MPI 
and a PROFIBUS interface can also be combined in one connection. CPUs with “PN” 
in the short designation have at least one PROFINET interface. A programming 
device can be connected via each of these interfaces. 


The project tree shows under Online access which interfaces (interface modules) are 
available in the programming device. The mechanical connection (the connection 
to a subnet) and the logical connection (the definition of the transmission proto- 
cols) are not configured. Only the bus and network addresses of the two devices 
must be matched to each other. 


In online mode, STEP 7 changes the representation of the user interface: The title 
bars of the windows are displayed in orange. In the project tree, the objects of the 
station which is switched online are assigned symbols which indicate their operat- 
ing or diagnostics state. 


You can use the online and diagnostics tools, for example, to control the operating 
state of the CPU, to set the time on the CPU, and fetch the diagnostic information, 
e.g. read the diagnostic buffer. The online and diagnostics tools support you in 
troubleshooting during commissioning. 


In online mode you transfer the program created offline to the CPU and test it. Two 
functions are available for testing the user program: the program status and the 
watch tables. You use the program status to monitor the program execution directly 
on the control functions. The watch tables contain tags whose values you can read 
and modify (control) during runtime or also set permanently (force). In addition, 
the offline and online versions of a block can be compared. 


You can also test a user program in the programming device without a connected 
CPU. The S7-PLCSIM simulation program is described in Chapter 18.3 “Simulation 
with the TIA Portal” on page 720. 
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15.1 Connection of a programming device to 
the PLC station 


The connection between a programming device and a PLC station is not configured 
with the hardware configuration. If you connect the programming device directly 
to the MPI of the CPU, the default properties of the interface are sufficient for online 
mode. When connecting via the PN interface, the programming device must be ad- 
dressed in the same subnet. Adaptation to the network configuration is carried out 
by STEP 7 by assigning a temporary IP address. 


You parameterize the interfaces of the CPU using the hardware configuration 
(Chapter 3.3.1 “Parameterization of CPU properties” on page 67). 


15.1.1 Settings on the programming device 


Setting network addresses for Industrial Ethernet in the operating system 


If your programming device is already working in a network, it has an IP address 
and a subnet mask which are matched to operation in the network. In most cases, 
integration into the network is made automatically through assignment of the 
network configuration by a DHCP server. 


You can check the settings in the properties of the LAN connection, for example 
with Start > Settings > Control] Panel and double-click on Network connections. 
Double-click on the used connection and click in the dialog window on the 
Properties button. Select Internet Protocol (TCP/IP) in the selection box in the prop- 
erties and click on the Properties button. The dialog window offers the options Ob- 
tain IP address automatically (via a DHCP server) and Use following IP address (man- 
ual settings). The Advanced... button leads to the advanced IP settings in which you 
can, for example, set additional temporary IP addresses and subnets masks. 


Set access point 


When installing STEP 7, the Set PG/PC interface tool is created in the Windows 
Control Panel. This can be used to check and set the interface to the network. 


Open the Set PG/PC interface tool, for example from the Windows desktop using 
Start > Settings > Control Panel. The Access Path tab should show S7ONLINE (STEP 7) 
in the Access Point of the Application box. In order to change the interface module, 
select the LAN interface module used under Interface Parameter Assignment Used 
click on OK. 


Interface (adapter) in the programming device 


STEP 7 lists all active interface adapters of the programming device in the project 
tree under Online access. In order to check and set the interface properties, click 
with the right mouse button on the interface used and select the Properties com- 
mand from the shortcut menu. In the properties window, select the subnet with 
which the programming device is to be connected under Assignment. 


593 


15 Online operation and program test 


15.1.2 Connecting the programming device to the PLC station 


Connect the programming device to the CPU using a cable appropriate to the interface. 


Switch on CPU 


Set the standby switch on the power supply module to OFF and the mode switch on 
the CPU to STOP, switch on the supply voltage, and set the standby switch to ON. The 
green LEDs for 5 V DC and 24 V DC on the power supply module light up. All LEDs 
light up when the CPU operating system ramps up. If the CPU does not detect any 
errors, the STOP LED lights up following ramping up. A red error LED lights up in 
the event of an error, and all LEDs flash if the CPU is faulty. 


If you set the mode switch to RUN, the CPU ramps up and the RUN LED flashes. If the 
CPU does not detect any errors during ramping-up, it changes to RUN mode - even 
without user program. 


The CPU is ready for communication in both the RUN and STOP modes. 


Search for accessible devices 


Start STEP 7, select the Online & diagnostics portal in the Portal view, and then select 
Accessible devices. If necessary, set the type of PG/PC interface in the Accessible 
devices window and the adapter used under PG/PC interface. 


A station which has been found is listed in the table with its address. At the same 
time, the graphic is provided with an orange background (Fig. 15.1). 


Accessible devices IX 


Type ofthe PGiPCinterface: | @_pnile y| 
PGIPCinterface: | Wi Realtek RTL8188CE Wirele..|¥| ©|-Q 


Accessible devices in target subnet: 


Device Device type Type Address MAC address 

CPU314C CPU 314C-2 PNIDP PNIIE 192.168.2.14 00-0E-8C-CC-30-75 
CPU315 CPU 315-2 PNIDP = PNIIE 192.168.2.15 00-0E-8C-AB-E8-62 
CPU 412-2 PN PNIIE 192.168.2.16 00-1B-1B-0E-A9-03 
SIMATICPC PNIIE 192.168.2.109 00-19-99-73-3A-17 


Distribution control 
q2330 


Flash LED 


Online status information: 
Scanning ended. a 


Fig. 15.1 Dialog window Accessible devices 
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Select the line with the station. You can then click the Flash LED button in order to 
briefly flash the FRCE LED on the front panel of the CPU. To process the selected sta- 
tion further in the project view, click on the Show button. 


Access over Industrial Ethernet, temporary IP address 


An online connection over Ethernet can only be established if both devices are in 
the same subnet. If the network settings of the programming device do not agree 
with those of the CPU, STEP 7 suggests the setting of a matching project-specific IP 
address on the programming device. This IP address is present temporarily until 
the programming device is switched off or until you delete the address. 


STEP 7 then shows the found CPU in the project view. The CPU is located with its IP 
or MAC address in the Online access group under the used interface module as a 
new group in the project tree. 


15.1.3 Switching on online mode 


Under Online access, select the PLC station and then Online & diagnostics from the 
shortcut menu. If the CPU does not yet have an IP address, enter the IP address and 
subnet mask in the diagnostics window under Functions > Assign IP address and 
click on Assign IP address. Then repeat the command Online & diagnostics. 


The diagnostics window displays the diagnostic data read from the PLC station and 
the Online tools task card with the CPU control panel. Further details can be found 
in Chapter 15.4 “Hardware diagnostics” on page 608. 


If a project matching the online PLC station is present, open the project and select 
the PLC station in the project tree. Select Go online from the shortcut menu or acti- 
vate the Go online icon in the main menu. If necessary, add the access data in the Go 
online window and click on Go online. 


Further procedure 


> Chapter 15.4 “Hardware diagnostics” on page 608 describes how you can use the 
diagnostics and online tools, for example to start and stop the CPU or to reset to 
the default settings. 


> The following Chapter 15.2 “Transferring project data” describes how you can 
upload a user program to the PLC station and edit the user program online. 


> Chapter 15.5 “Testing the user program” on page 613 describes how you can test 
a user program. 


> Chapter 15.2.4 “Editing of online project without offline project” on page 600 
describes how you can access the online project data of the CPU without the user 
program. 
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15.2 Transferring project data 


You have configured the hardware and completed and compiled the user program. 
You can now carry out the transfer to the PLC station via an online connection or 
using a memory card as data medium. 


If you transfer the user program to the CPU via an online connection, it is written 
into the load memory. In the case of a CPU 400, the load memory is on the CPU. For 
larger user programs, a memory card is required as a load memory expansion. 


If you use a FLASH memory card, you can use the CPU-intern RAM load memory for 
smaller program changes. For larger changes, only the entire user program may be 
transferred. If aRAM memory card is used, individual blocks can also be loaded or 
deleted. 


You can also write to a FLASH memory card in the programming device and use it 
as data medium. Transfer the project data from the offline data management to the 
memory card inserted in the programming adapter and then insert the memory 
card into the CPU in the deenergized state. Following a memory reset when switch- 
ing on, the data relevant to execution is transferred from the memory card to the 
CPU's work memory. 


15.2.1 Loading project data for the first time 


To load the project data, connect the programming device to the CPU, switch the 
CPU on, and open the project on the programming device. 


Select the PLC station in the project tree and then the Download to the device > All 
command from the shortcut menu. When loading for the first time, the dialog win- 
dow Extended download to device shows the address of the configured PLC station 
in the Configured access nodes of ... table. If applicable, select the adapter to which 
the PLC station is connected from the drop-down lists Type of the PG/PC interface 
and PG/PC interface. The Online status information table signals the status and the 
end of scanning for stations. 


Select the desired station in the Accessible devices in target subnet table and click on 
the Load button. 


The PLC station does not have the configured address 


If the configured address does not agree with the address set in the CPU, STEP 7 can- 
not find the device matching the configuration. Activate the Show all accessible 
devices checkbox in this case. The search then starts again. 


The devices that have been found are displayed together with their addresses in the 
table Accessible devices in target subnet. Select the required PLC station in this table 
and click on the Load button. 


If the network settings of the programming device do not match the configured IP 
address when connecting via the PN interface, the dialog window Assign IP address 
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is displayed. Following confirmation, STEP 7 then adds a further temporary, proj- 
ect-specific IP address. 


The project data is compiled prior to loading 


If necessary, the project data is compiled prior to loading. Only consistent project 
data which has been compiled without errors can be loaded. The compilation pro- 
cess can be observed in the dialog window Load preview. 


After error-free compilation, set the further behavior in the Load preview dialog 
window, for example for “Stop modules”, “Load device configuration”, and “Load 
software”. In the Action column you can use the drop-down list to change or deselect 
the suggested action. You can continue with loading by clicking on the Load button 
(Fig. 15.2). 


Coad proviaw x 
2) Check betore losding 
Stetus =| Target Message Acten 
an iv] = Ontnbuton control Ready tor loading - 
oe > Device confguration Delete and replace systern dats in target Download to device 
iv] - Compress memory Compress memory due to lack of memory? Compress all 
Distribution control may have insuficient memory Compress? 
(v) spece evadable! 
9 + softwere Download software to device Consistent downioed 
iv) + Download to device Biocks that do not enst onine 
iv} Status [P8210] v7) Download to device 
9 © Overwrite online? Online blocks wall be overwritten 
iv) Moter_control_2 [FC202] J) Overwrite 
o Velve_contrct [FC203] 7) Overwrite - 
Retesh 
Load Cancel 


Fig. 15.2 Dialog window Load preview 


The device configuration can only be loaded when the CPU is at STOP. You can select 
the following for loading the software: Consistent download (all previously selected 
blocks and the blocks with their call are loaded) and download selection (only the se- 
lected blocks are loaded). If you select the Program blocks folder and load all blocks, 
blocks that are not available offline are deleted online). 


Start CPU following loading 


The results of loading are displayed in the dialog window Load results. Following 
loading without errors, you can start the CPU with the new user program. 


Caution: Make sure when starting the CPU - possibly with a faulty program - that the 
controlled machine cannot cause damage to property or injury to persons and that no 
dangerous states can occur! 
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If the CPU was in RUN mode prior to loading, the Start all checkbox is activated in 
the Action column. If it was at STOP, activate the checkbox in order to start the CPU. 
Click the Finish button. 


With the Start all checkbox activated, the CPU is started following completion of load- 
ing. If no errors occur, the CPU is then in RUN mode. The green RUN LED lights up. 


Switching to online mode 


In order to switch online mode on, select the PLC station or the Program blocks fold- 
er and then select the Go online command from the shortcut menu or activate the 
Go online icon in the main menu. 


The title bar of the active window has an orange background. The project tree uses 
icons to indicate the agreement and existence of offline and online versions for 
each block. You can now: 


> Open the diagnostics window 
(see Chapter 15.4.2 “Diagnostic information” on page 609 for informa- 
tion on online access and module status, reading the diagnostic buffer, 
updating the firmware, etc.) 


> Use the online tools 
(see Chapter 15.4.5 “Online tools” on page 611 for control of CPU, display of 
current cycle time and memory configuration) 


> Edit and compare blocks online and offline 
(see Chapter 15.3 “Block handling” on page 602) 


> Test the user program 
(see Chapter 15.5 “Testing the user program” on page 613) 


You can use the Go offline connection icon to switch online mode off again. 


15.2.2 Reloading the project data 


When reloading project data, only the changes compared to the online project data 
are loaded. It is possible to specify for the software (user program) whether only the 
changes are loaded or everything. 


When using the command for loading, you define which project data is to be loaded. 
Select the object to be loaded in the project tree and then the Download to device > ... 
command from the shortcut menu. You can: 


> Select the All, Hardware configuration, Software, or Software (all blocks) 
commands for the selected PLC station 


> Select the Software or Software (all blocks) commands with the Program blocks 
folder selected 


> Select the Software command with one or more blocks selected 


Independent of the selection by the load command, only the objects are reloaded 
which differ from the corresponding objects in the CPU. 


The result of loading is shown in the inspector window under Info > General. 
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Changing configuration data of CPU 


Changing configuration data is only possible in offline mode. Switch to offline 
mode, modify the configuration data offline, and transfer it to the CPU. If you only 
wish to transfer the configuration data, select the PLC station in the project tree and 
then the Download to device > Hardware configuration command from the shortcut 
menu. 


The CPU is switched to STOP during loading. 


Starting the CPU 


If the CPU was at RUN prior to loading, you will be asked in the dialog window 
Load results whether the CPU is to be started (Start modules after downloading to 
device message with Start all checkbox activated). 


Caution: Make sure when starting the CPU - possibly with a faulty program - that the 
controlled machine cannot cause damage to property or injury to persons and that no 
dangerous states can occur! 


Continue by clicking on the Finish button. Loading has been completed when the 
RUN LED flashes briefly and then lights up permanently. 


Loading an incorrectly compiled, inconsistent program 


An error which occurs when compiling prior to loading is indicated in the dialog 
window Load preview. The Target column indicates under Software (click triangle on 
the left) the component for which the error has occurred. Continuation or restart of 
loading is only possible when the error has been eliminated. 


Error message following loading 


If the CPU does not start following loading - the yellow STOP LED lights up - orifa 
red error LED lights up or flashes, the diagnostic buffer can provide information on 
the cause. Remaining in the STOP state or returning to it could be the result of, for 
example, a faulty I/O access in the user program. 


15.4.3 “Diagnostic buffer” on page 609 describes how the diagnostic buffer sup- 
ports you during troubleshooting. 


15.2.3 Protection of the user program 


With a CPU 400, access to the user program can be protected by a password. Anyone 
with knowledge of the password has unlimited access to the user program. You can 
define three protection levels for all those who do not know the password. You set 
the protection levels in the Protection tab with the hardware configuration when pa- 
rameterizing the CPU. 


Access protection by the password applies to the duration of the online connection 
or until the access privilege has been canceled again using Online > Delete access 
rights. 
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The following protection levels are possible: 


> Protection level 1 (no protection) is the default setting. It means that there are 
no limitations to access to the user program. With the system function PROTECT, 
the write protection (protection level 2) can be switched on and off via the pro- 
gram in protection level 1 (see Chapter 5.5.5 “Compress, hold, stop, and protect 
program” on page 186). 


> In protection level 2, the user program can only be read. 


> In protection level 3, it is neither possible to read nor write the user program. 
Exception: Reading the diagnostic buffer and monitoring tags using watch tables 
are possible in every protection level. 


If you select either protection level 2 or 3, you will be requested to define a pass- 
word. The password has a maximum length of 8 characters. 


The protection is effective once the settings have been loaded to the CPU. If you 
access a CPU which is protected by a password, you will be requested to enter the 
password. Anyone in possession of the password has unlimited access to the CPU, 
independent of the protection level set. 


Know-how protection with source files 


In the case of source files for STL and SCL blocks it is possible to protect a block 
against undesired access by using the keyword KNOW_HOW_PROTECT. You can no 
longer cancel this protection, in contrast to block protection with password in the 
TIA Portal (see Chapter 18.1 “Working with source files” on page 707). 


15.2.4 Editing of online project without offline project 


You can also open the program in a CPU without the associated project. 


Select the Online & diagnostics portal in the Portal view and then select Accessible 
devices. Set the LAN adapter (the PG/PC interface module) if applicable. Select the 
PLC station in the Accessible devices list and click on the Show button. If the pro- 
gramming device does not possess the matching network parameters, STEP 7 
opens a dialog window to allow you to set these temporarily. 


In the project view, the PLC station is displayed in the project tree under Online 
access and the used interface (module). Alternatively you can double-click under 
the used interface on Update accessible devices. The accessible PLC stations are then 
displayed as folders under the interface. 


Select the PLC station and then the Online & diagnostics editor from the shortcut 
menu. In online mode, you can select the mode using the CPU control panel, for ex- 
ample, or read out the diagnostic buffer in the diagnostic functions. 


The Program blocks folder contains the online blocks. If you open it, STEP 7 loads 
the blocks into the folder. A block is opened by double-clicking it and the program 
in the block is displayed. 
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If you wish to edit, delete, or test an online block, you must create an offline project 
and transfer the online blocks to the project. Only blocks which are present offline 
can be newly created, modified, deleted, or tested. 


Uploading the project data from the CPU 


Uploading of online project data requires an offline project in the programming de- 
vice. If the offline project matching the online project is not available, create an 
“empty” offline project and then copy the online project data into the project. 


You have established an online connection to the PLC station via Online access. Now 
create a new project with Project > New in the main menu and add a PLC station with 
a suitable CPU to the project with Add new device. Drag the Program blocks folder 
from the PLC station under Online access to the Program blocks folder in the PLC sta- 
tion in the newly created project. 


Alternatively, create a new project, add a suitable PLC station to it, set the appropri- 
ate access data, and activate online mode. Select the Program blocks folder in the 
project tree and select the command Online > Upload from device from the main 
menu. 


In both cases, the Program blocks, PLC tags, and PLC data types folders present in 
the offline data management are deleted and replaced by the objects existing on- 
line. 


15.2.5 Working with the memory card 


A SIMATIC Memory Card (MC) for a CPU 400 is amemory card preformatted by Sie- 
mens. Do not use the SIMATIC Memory Card for non-SIMATIC purposes and do not 
format the memory card with third-party devices or Windows tools. If the internal 
structure of the memory card is destroyed, the memory card is unfit for use in a CPU 
400. 


The load memory integrated in the CPU is expanded with the memory card. To in- 
sert the memory card, set the mode switch to the STOP position, insert the memory 
card, and perform a general reset (see Chapter 5.1.5 “Reset CPU memory” on page 
149). If you insert or remove the memory card with activated control, the CPU re- 
quests a general reset by slowly flashing the STOP LED. If you insert or remove the 
memory card with the control switched off, the CPU performs a general reset after 
restarting. 


The memory card is available as RAM memory card and as FLASH memory card. 


Working with a RAM memory card 


ARAM memory card is exclusively used to expand the integrated load memory. The 
program on the memory card is backed up by the backup battery in the power sup- 
ply module or by an external backup voltage at the EXT-BATT socket on the CPU. If 
the RAM memory card is pulled out, the user program on it is lost. 


For aRAM memory card, you can reload, change, or delete individual blocks during 
operation without restriction. 
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Working with a FLASH memory card 


The EEPROM memory on a flash memory card retains the program even with the 
power off. You can transfer a new firmware or a user program to the CPU with a 
FLASH memory card. You can write to a FLASH memory card in a suitable program- 
ming adapter on the programming device or in the CPU. If the FLASH memory card 
is inserted in the CPU, only the entire user program can be transferred. 


With a FLASH memory card, you can reload, change, or delete individual blocks 
during operation, to the extent the size of the integrated RAM load memory permits 
this. 


15.3 Block handling 


Prerequisite: The project data has been transferred to the CPU and online mode is 
switched on. 


The project tree uses icons at the blocks to identify differences between the offline 
and online versions: A green, filled circle indicates that both versions are the same, 
two blue/orange semicircles indicate that the two versions are different, and if one 
semicircle is not filled, the corresponding block version is missing (blue stands for 
offline, orange for online). 


You can now change the offline version of a block and load the modified block into 
the CPU. You can delete the online and/or offline version of a block. Finally, the 
offline version of a block can be compared with the online version or offline version 
in a different device. 


The online version of one or more blocks can be loaded or deleted in the STOP state 
or RUN mode. 


Caution! Reloading or deleting blocks during operation of the plant can cause serious 
damage to property or injury to persons if there are functional disturbances or pro- 
gram errors! Make sure that no dangerous situations can arise before you start the 
actions! 


15.3.1 Downloading a block to the CPU 


To download into the CPU, select one or more blocks in the project tree in the 
Program blocks folder or choose the command Download to the device > Software 
from the shortcut menu. Alternatively, you can select Online > Download to device 
from the main menu. With the command Online > Extended download to device..., 
you can select the PLC station before loading. 


You can also download a block you are processing at the moment from the program 
editor into the CPU. With the block open, select the Online > Download to device com- 
mand from the main menu in order to load the block into the set online project, or 
select Online > Extended download to device in order to select the PLC station prior 
to loading. 
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The block(s) will be compiled. Loading is aborted if errors occur during compila- 
tion. Only blocks which have been compiled without errors can be downloaded. 


The envisaged actions are listed in the Load preview window. Consistent download 
means that all blocks called in the selected blocks are loaded in addition to the 
selected blocks. Set the desired actions in the Action column and click on the Load 
button. The Load results window provides information on the status of the loading 
process. To terminate loading, click on the Finish button. 


15.3.2 Editing the online version of a block 


A block can only be modified in the offline version. If you wish to modify the online 
version, you must carry out the change in the offline version and subsequently 
transfer the block to the CPU. 


If you change the online version of the block, for example by adding a new scan of 
logic operation during program testing, STEP 7 automatically switches to the of- 
fline version. Following the modification, you transfer the modified offline version 
to the CPU, for example by right-clicking on a free space in the working window and 
the Download to device command from the shortcut menu. 


Adding a block online 


Using the Add new block tool in the project tree, you can generate the offline version 
of a new block, even if online mode is switched on. Program the offline version of 
the block and the associated block call - if the new block is not an organization 
block - and then transfer the calling and called blocks to the CPU. 


15.3.3 Deleting a block 


You delete a block if you select it in the project tree and then the Delete command 
from the shortcut menu. If online mode is switched on and you wish to delete a 
block which is present both online and offline, the program editor asks which of the 
blocks is to be deleted: the online block (Delete from device), the offline block (Delete 
from project), or both. 


Before deleting a block in the CPU, you should delete its call, i.e. remove the call of 
the block to be deleted from the calling block, otherwise the program execution 
error The called block does not exist is signaled during runtime. 


15.3.4 Packing the work memory 


If you wish to load a new or modified block into the CPU, the latter stores the block 
in the load memory and transfers the parts relevant to execution to the work mem- 
ory. If a block with the same number already exists, this “old” block is declared as 
invalid in the memory management and the new block is added to the work mem- 
ory “from behind”. A deleted block is also “only” declared as invalid and is not ac- 
tually removed from the memory. 
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Gaps result in the work memory in this manner which reduce the memory space 
available for assignment more and more. The gaps can only be filled using the 
Compress function. If you carry out compression in RUN mode, the blocks currently 
being processed are not shifted; compression without gaps is only achieved when 
in the STOP state. 


Online mode must be switched on to allow compression. Double-click in the project 
tree under the PLC station on the Online & diagnostics tool. You can then find the 
Compress button 


> in the working window under Diagnostics > Memory and 


> in the task window with the online tools on the Memory pallet. 


The Compress button reorganizes the work memory in order to increase the largest 
continuous free memory area. No other online jobs such as the program status 
must be active. 


Under Diagnostics > Memory in the working window, the memory assignment 
shows the largest continuous memory area in the Largest free block line. 


With the system function COMPRESS, you can initiate compression in the user pro- 
gram, even during runtime (Chapter 5.5.5 “Compress, hold, stop, and protect pro- 
gram” on page 186). 


15.3.5 Offline/online data blocks 


The offline and online versions of a data block are handled like a code block. It is 
also the case with a data block that only the offline version can be modified directly, 
i.e. data tags can be added, modified, or deleted. However, the offline and online 
versions of a data block usually have different contents, i.e. different values for the 
data tags, for these can be modified by the user program during runtime. 


Offline data block 


If you program a data block, data tags are assigned a start value depending on their 
type. As standard, the default value is the start value. With data type INT, for exam- 
ple, it is the value zero, with data type DATE it is the value D#1990-01-01. You can 
modify the start value. 


The start values are therefore present in the offline version of a data block. If the 
data block is transferred to the CPU, it is present with the start values in the load 
memory. The data block is transferred to the work memory during a CPU start, and 
the start values of the data tags can be changed in this memory by means of the user 
program. The values of the data tags in the work memory are referred to as actual 
values. (Fig. 15.3) 


Online data block 


The online version of the data block is available twice: once in the load memory with 
the start values and once in the work memory with the actual values. 
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Data blocks in offline and online data management 


Programming device 


Offline data storage 


Default value 
If no special start value is 
programmed, the default 
value is used as the start 
value. 
Start value 


Programming device 


Offline data storage 


Default value 
The previous start value in 
the offline data 
management is lost. 
Start value 


When downloading into the CPU, 
the start value is transferred 
from the offline data 
management to the load memory. 


When uploading from the CPU, 
the actual value is transferred 
from the work memory to the 
offline data management. 


CPU module 


Load memory Sinivatee 


The data block with the start 
values is imported into the 
work memory. 


Work memory 

The start value becomes the 
actual value in the work 
memory. The actual value is 
the value changed by the 


Current value 


CPU module 


EpagmeM ny: Start value 


The start value in the load 
memory is not changed when 
uploading. 


Work memory 

The actual value is present in 
the work memory, and can 
differ from the start value in 
the load memory. 


Current value 


user program. 


Fig. 15.3 Data storage in the user memory 


The actual values are displayed in the declaration table in the data block in moni- 
toring mode in the Monitor value column. On request (Snapshot of the monitored 
values icon), the current actual values are “frozen” and displayed in the Snapshot 
column. You can then manually transfer a value from the Snapshot column to the 
Start value column. 


If you upload all blocks from the CPU to the offline data management with the 
Program blocks folder selected and the Upload from device command, the actual val- 
ues for data blocks are imported from the work memory as start values into the 
offline data management and the start values in the load memory remain un- 
changed. Following a further upload to the CPU, the start values of the offline data 
management are present in the load memory. 


15.3.6 Comparing blocks 


The comparison editor allows you to compare an offline version of code and data 
blocks with the respective online version or with an offline version from a different 
project. 


With an offline/online comparison, the blocks are assigned by means of the abso- 
lute address (block type and number), with an offline/offline comparison by means 
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of the symbolic address. If the time stamps of the two blocks agree, the comparison 
editor assumes that the blocks are the same. 


Comments and block attributes are not considered in the comparison. 


Comparing offline/online blocks 


An online connection to the CPU is required for the offline/online comparison. The 
comparison can be carried out in the STOP state or RUN mode. 


To start the comparison editor, select the PLC station or the Program blocks folder 
in the project tree and then select the Compare > Offline/online command from the 
shortcut menu or the Tools > Compare > Offline/online command in the main menu. 
The respective subordinate objects are compared. 


The comparison editor displays the compared objects and the comparison status in 
the working window. As standard, objects which have different offline and online 
versions are displayed (Fig. 15.4). You can control the display using the Show only 
objects with differences and Show identical and different objects icons. 


es |[Compare all blocks iy) & ON =| 
“Distribution contro!" offline compared to online 
@ Reference program Seatus Acton @ Compare to Detadts 
© [jg Distribution contro! OZ Oeterent actions Distribution control al 
w ‘gp Program blocks OZ Oeterent acnons | 
@ Main (081) @ Wh Noaction 081 (081) Code is different 
> Stews [FB210) ) F210 [FB210) 
@ Bett ders (08100) ) DB 100 [DB 100} 
@ Monaceing dots (08200) eo DB200 (DB700} 
@ St5tus_0e [08210] -) DB210 [DB2 10} 
+ "h] Conveyor belr OD ZF Oeterent actions 
@® Oistance_setection felt! [FC211) i?) FC214 [FC239) 
@® Oistance_detection_Belt2 (FC212} ry FC212 [FC212) 
@® Oistance_setection_Belt3 [FC213} © = --# Downicad to deve = Not existing 
@® Distence_setection_Beirs [FC214) QO © Oriew Not exsnng 
@® Orive_monitoring {FC178} ry FC178 [FC178)} 
@ MH draviic_control [FC204] o fi No acnon FC208 [FC204) Code ts diferent 
@® Motor_control_1 [FC201] rey FC201 [FC201] 
@ Notor_control_? [FC202} eo FC202 [FC202] 
@® Power_control [FC205} my FC205 [FC205] | 


Fig. 15.4 Example of comparison of blocks 


A green, filled circle indicates that the offline and online versions are identical. 
Blue-orange semicircles indicate that the object's offline and online versions differ. 
If one semicircle is not filled, the corresponding version is missing (left side or blue 
stands for offline, right side or orange for online). An exclamation mark in an 
orange circle indicates an object with differences in the identified folder. 


606 


15.3 Block handling 


In the Action column and depending on the comparison status, you can select from 
a drop-down list between 


> No action 
> Delete, the existing version is then deleted 
> Download to device, the offline version is then loaded to the PLC station 


> Load from device, the online version is then loaded to the programming device 
(not for SCL and GRAPH blocks) 


Clicking on the Execute actions icon in the toolbar starts the set actions. The com- 
parison is carried out again by using the Refresh the view icon. You can only carry 
out one offline/online comparison at a time. 


Comparing offline/offline blocks 


To start the comparison editor, select the PLC station or the Program blocks folder 
in the project tree and then select the Compare > Offline/offline command from the 
shortcut menu or the Tools > Compare > Offline/offline command in the main menu. 


Select the project with which the current project is to be compared in the displayed 
dialog window. The further procedure is as with the offline/online comparison. The 
comparison icons are now blue for objects of the current project and gray for ob- 
jects of the selected project. 


With an offline/offline comparison of stations, the PLC tags and the PLC data types 
of both projects are also compared. It is indicated whether the PLC tag table or PLC 
data types are present, whether differences exist, and how many PLC tags are con- 
figured. You can only carry out one offline/offline comparison at a time. 


Detailed comparison 


You can start a detailed comparison for a block. The compared versions of the block 
are then displayed next to each other and the differences highlighted. The detailed 
comparison is not available for SCL and GRAPH blocks. 


To start the detailed comparison, select a block in the comparison editor and acti- 
vate the Start detailed comparison icon or select the Start detailed comparison com- 
mand from the shortcut menu. 


The opened block versions are displayed next to each other. You can use icons in the 
comparison editor's toolbar to navigate to the first, preceding, subsequent, or last 
difference. If the Synchronize scrolling between editors icon is activated, the corre- 
sponding networks remain visible in parallel when scrolling vertically. If networks 
are missing or if the sequence is interchanged, the comparison editor inserts 
“pseudo-networks’” with the heading A corresponding network was not found. These 
networks cannot be edited. 


You can modify the offline version of the open block. A new comparison is carried 
out using the Update comparison results icon. 


607 


15 Online operation and program test 


15.4 Hardware diagnostics 


The hardware diagnostics detects and signals module faults, e.g. failure of the load 
voltage or an open-circuit on signal modules. 


The modules with diagnostic capability distinguish between parameterizable and 
non-parameterizable diagnosis events. In the case of the parameterizable diagno- 
sis events, the message is only output if you have enabled the diagnostic function 
in the parameter settings. The non-parameterizable diagnosis events are always 
signaled irrespective of a diagnostics enable. 


This chapter describes the diagnostics options offered by the programming device 
in online mode. Chapter 5.8 “Diagnostics” on page 226 describes how you can react 
to a diagnosis event in the program. 


When a diagnosis event occurs: 
> anerror LED lights up on the CPU 
> The diagnosis event is passed on to the CPU's operating system 


> A diagnostic interrupt is triggered if you have enabled this in the parameter 
settings (the diagnostic interrupts are disabled by default) 


All diagnosis events signaled to the CPU's operating system are entered into a diag- 
nostic buffer in the sequence of their occurrence with date and time. In addition to 
the diagnostic buffer, which saves the events in chronological order, the program- 
ming device offers comprehensive information functions which display the current 
module states. 


15.4.1 Status displays on the modules 


The status displays on the modules signal a malfunction and can help to localize the 
fault. The CPU's operating system signals a malfunction in the following manner: 


> The INTF LED lights up permanently. 
There is an internal CPU error. 


> The EXTF LED lights up permanently. 
There is an external CPU error. 


> The STOP LED lights up permanently. 
The CPU does not enter RUN mode when switched on or goes to the STOP state 
during RUN mode. Possible causes: Manual change in mode through the 
programming device, set startup type (“Startup - STOP”), STP function in user 
program, system response to an execution error in the program. The events trig- 
gering the STOP state are entered into the diagnostic buffer. 

> The STOP LED flashes. 
The CPU requests a memory reset (flashing at 0.5 Hz) or carries out a memory 
reset (flashing at 2 Hz). 


CPUs with MPI, DP or PN interface report a bus fault via the BUSIF, BUS2F and 
BUS5F LEDs, and report an error of the IF module interface with the IFM1F and IF- 
M2F LEDs. 
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Every input/output channel of a digital module has a green status LED to indicate 
whether voltage is present on the input or output channel. It is thus possible to 
check the wiring from the sensor to the digital input channel or from the digital 
output channel to the actuator. 


Digital and analog modules with diagnostic capability have an SF LED (group 
error), which lights up when a diagnosis event occurs. The SF LED goes out when 
all errors has been resolved. 


15.4.2 Diagnostic information 


The diagnostic information is displayed in the working window when the program- 
ming device is switched to online mode using the Online & diagnostics command. 
The following diagnostic information is then available: 


> General: Module designations, module and vendor information. 


> Diagnostics status: Status information of selected module, e.g. Module present 
and OK, differences between configured and existing modules. 


> Diagnostic buffer: Display of diagnostic buffer content. 


> Cycle time: Display of preset or configured minimum cycle time and cycle (mon- 
itoring) time and - in RUN mode - the cycle time diagram and the shortest, cur- 
rent, and longest cycle (processing) times measured. 


Memory: Display of the memory usage separated by RAM and EPROM for the load 
memory, and separated by program code and data for the main memory. 


Communication: Display of connection resources and cycle load resulting from 
communication. 


MPI, DP and PN interfaces: Properties of the corresponding interface. 


Runtime meter: Display of runtime meter used and count value. 


Performance data: Display of CPU performance data (quantity frameworks for 
operand areas, organization blocks, system blocks). 


Cycle times and resources are displayed in parallel in the online tools. 


15.4.3 Diagnostic buffer 


The diagnostic buffer contains the faults detected by the CPU and the modules with 
diagnostic capability, the triggered hardware and diagnostic interrupts, and the 
changes in CPU modes in the sequence of occurrence. The diagnostic buffer is 
designed as a ring buffer: when it is full, the oldest entries are overwritten. 
The entries can only be erased by resetting the CPU to its factory settings (Fig. 15.5). 


The most recent event is present in the first line in the diagnostic buffer. A 
diagnostic buffer entry consists of the time stamp (date and time at which the event 
was detected) and the event text. The time stamp is only meaningful if the CPU's 
time is up-to-date. An event ID can be called up for every event. This is an identifi- 
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Diagnostics buffer 


Events 


{-) Display CPU Time Stamps in PGIPC local time 


No. Date and time Event 
1 11/21/2012 08:51:09.528 New startup information in STOP mode otha 
11/21/2012 08:51:09.522 STOP caused by programming error (OB not loaded or not possible, or no FRB) & 
11/21/2012 08:51:09.522 FB notloaded oS 
11/21/2012 08:50:18.183 Mode transition from STARTUP to RUN i 
11/21/2012 08:50:17.171 Request for manual warm restart & 
11/21/2012 08:50:17.149 Mode transition from STOP to STARTUP ot 
11/21/2012 08:50:17.148 New startup information in STOP mode & 
11/21/2012 08:50:15.498 New startup information in STOP mode & 
11/21/2012 08:50:15.493 STOP caused by stop switch being activated Ef 


ononrnaoaunr Wn 


| Freeze display 


Details on event 


Detailsonevent: [3 | of [16 | EventID: [16# 253E 


Description: | FB not loaded [a] 
FB number: 210 
OB number: 1 
Module address: 22 
Requested OB: Programming error OB (OB121) 
OB not found, or disabled, or cannot be started in the in the current operating mode 


M 


Time stamp: [11/21/2012 08:51:09.522 _ 


Incoming/outgoing: | Incoming event 


Help on event lf Open in editor Save as... 


Fig. 15.5 Example of display of diagnostic buffer 


cation which exactly specifies the event. Select a line and the event ID will be dis- 
played on the right underneath the table. 


Using the Help on event button, you can obtain additional information on the select- 
ed event. If the entry refers to a block, e.g. with an access error to the I/O, it is pos- 
sible to switch to the position of the fault in the user program by using the Open in 
editor button. 


The Freeze display button stops the display of entries; you can then call up informa- 
tion on a specific event or study the sequence of displayed events at your own rate. 
Clicking on the button again (now labeled: Cancel freeze) changes to the updated 
display. You can use the Save as ... button to save the contents of the diagnostic buf- 
fer as a text file. 


In the Settings area (not shown in the figure), you can set a filter for the events to be 
displayed and import this filter as standard for future display of the diagnostic buffer. 


15.4.4 Diagnostic functions 


The diagnostic functions are displayed in the working window when the program- 
ming device is switched to online mode using the Online & diagnostics command. 
The following functions are then available: 
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Assign IP address: Setting of the IP address, subnet mask, router address. 


Set time: Display of programming device and module time, setting of real-time 
clock on CPU, time synchronization. 


Firmware update: Display of current firmware and preparations for updating the 
firmware. 


Assign name: Enter or change the PROFINET device name. 


Reset to factory settings: The user memory, operand areas, diagnostic buffer, 
and IP address are deleted. All parameters including the time are reset to the de- 
fault settings. 


15.4.5 Online tools 


You can use the Online & diagnostics command from the project tree to start the task 
card with the online tools. 


CPU control panel 


The CPU control panel shows the current status of the LED on the front panel of the 
CPU. The RUN and STOP buttons can be used to set the CPU - following confirma- 
tion — to the corresponding state. A pressed (bright) button symbolizes the current- 
ly set state. The CPU can only be switched to RUN mode using the control panel if 
the mode switch on the CPU is at RUN and if no faults which prevent starting are 
present. 


The MRES button is used to trigger a memory reset. Amemory reset can only be car- 
ried out in the STOP state. During the memory reset, the contents of the work mem- 
ory and all operand areas are deleted. The contents of the load memory are re- 
tained. The contents of the load memory relevant to execution are copied into the 
work memory, just like when transferring the user program to the CPU. The diag- 
nostic buffer, time, force jobs, and IP address remain uninfluenced. 


The existing (logic) connections to the CPU are cleared. Following a CPU memory 
reset, the programming device must switch to online mode again using the 
Online & diagnostics or Go online command. 


Cycle time 


Cycle time shows the shortest, current, and longest cycle (processing) times in mil- 
liseconds and presents these graphically. 


Memory 


Under Memory, the utilization of the load and work memories is displayed as bars. 
The Compress button can be used to minimize the utilization of the work memory. 
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15.4.6 Further diagnostic information via the programming device 


Diagnostics icons in the device and network views 


In online mode, the device configuration editor shows the device status of every 
PLC station connected online by means of diagnostics icons in the device or net- 
work view. For example, a green tick indicates that the station does not signal any 
faults. The operating state is indicated by a colored square: green for RUN and yel- 
low for STOP. 


Diagnostics icons in the project tree 


In online mode, diagnostics icons are also shown in the project tree. If everything 
is OK in the PLC station, the name is followed by a white tick on a green background. 


The project tree also shows the result of the comparison between offline and online 
project data. If an orange circle with exclamation mark is shown, the folder contains 
objects which differ in the online and offline versions. The following identifications 
apply to individual objects: 


Green, filled circle: Everything OK 


Blue/orange semicircles: The online and offline versions of the object 
are different 


Blue/orange semicircle, right half (orange) filled: Only the online object is 
present 


Blue/orange semicircle, left half (blue) filled: Only the offline object is present 


Device information in the inspector window 


The status of the devices signaled as faulty is displayed in the inspector window in 
the Diagnostics > Device information tab. A device is considered to be faulty if it is 
inaccessible when establishing the online connection, if it signals a fault or if it is 
not in RUN mode (Fig. 15.6). Via the link in the Details column you can access the 
Go online dialog or the online and diagnostics view of the faulty device. 


Diagnostics || 


[Properties |7ijInfo | %| Diagnostics {| 


Alarm display Device information Connection information 
1Devices with problems 
IW? Online. “i Opera... Deviceimodule Message _ Details Help 
12 | a Distribution control _ © For more detailed information, refer to module diagnostics. ? 


Fig. 15.6 Diagnostics tab in the inspector window 
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15.5 Testing the user program 


Following the establishment of a connection to a CPU and loading of the user pro- 
gram, you can test the entire program or parts of it, such as individual blocks. You 
supply the tags with signals and values and evaluate the information returned by 
the program. If the CPU switches to STOP as the result of a fault, the diagnostic buf- 
fer provides support toward locating the cause. 


Comprehensive programs are tested in sections. If you only wish to test one block, 
for example, load the block into the CPU and then call it in OB 1. If OB 1 is structured 
such that the program can be tested in sections “from front to rear”, you can select 
the blocks or program sections to be tested in that you bypass the calls or program 
sections which are not to be processed, e.g. using a jump function. 


The following testing functions are available: 
> Testin program status 
Monitor program execution directly in the program of the block and control tags 


> Test in single step mode 
Step-by-step execution of an STL or SCL program with monitoring of the tag 
values 


Monitor PLC tags 
Monitor the values in a PLC tag table 


Monitor data tags 
Monitor the tag values in a data block 


Test with watch tables 
Monitor and control the tag values in watch tables 


“Enable peripheral outputs” and “Modify now” 
Control peripheral outputs with CPU at STOP 


Test with force table 
Monitor the tags in the force table and set to a fixed value (force) 


A general prerequisite for testing the user program is an existing online connec- 
tion. When testing with program status and in single step mode, the offline and 
online versions of the block must be identical. 


You can use the S7-PLCSIM option software to simulate a CPU in the programming 
device and thus test your program without additional hardware (see Chapter 18.3 
“Simulation with the TIA Portal” on page 720). 


15.5.1 Process and test modes 


The user program is usually executed in Process mode. In process mode, impair- 
ment of program execution is kept as low as possible and the effect on the cycle pro- 
cessing time remains minimal. The result is that there are limitations when testing. 


Testing with the program status, which has a large influence on the cycle process- 
ing time, and even more so the individual step processing (which can in fact stop 
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program execution), can only be carried out in test mode. In test mode, all testing 
functions can be used without limitation. 


You switch on test mode if you activate the Test mode checkbox on the Testing task 
card in the Breakpoints pallet. Deactivate the checkbox in order to switch off test 
mode. 


When testing with the program status, you can select before switching on whether 
testing is to be carried out in process mode or test mode. Note that there may be dis- 
turbances in the controlled system when using test mode due to the increase in 
cycle time. When testing in single step mode, a requirement is that test mode is 
switched on. 


15.5.2 Defining the call environment 


If you wish to test the user program at a specific position in the program status, you 
open that position of the program in the working window and switch on the test 
function. In single step mode, you set a breakpoint at the position to be tested in the 
block program. 


If the program position to be tested is in a block which is called repeatedly in the 
user program, you must define the block call you wish to test. 


You set the call environment in the tasks window on the Testing task card in the 
Call environment pallet. If the condition applies, the program status is recorded or 
a jump is made to the breakpoint located in the specified call of the block. You can 
make the following settings when you click the Change button: 


> Global data block 
The condition is fulfilled if the global data block specified when calling the code 
block is open. 


> Instance data block 
The condition is fulfilled if the instance data block specified when calling the 
code block is opened. 


> Call path 
The condition is fulfilled if the call of the code block is made from the specified 
block or from a specific path. 


If the call environment is not defined, the program status of an optional call is re- 
corded in the case of a repeated call or a jump is made to the next breakpoint. 


15.5.3 Testing with program status 


The program status shows the program execution during runtime. You can monitor 
the current signal status of the binary tags and the current values of digital tags. 


Caution! Functional disturbances may occur as a result of program modifications 
when testing the user program during ongoing operation on the process. Make sure 
with each testing step that no serious damage to property or injury to persons can 
occur! 
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You can execute the program status in process mode (small influencing of cycle 
time) or in test mode (no limitation in test functions). 


Switching the program status on and off 


To switch on the program status, open the block to be monitored, move on to the 
program position you wish to test, and click on the Monitoring on/officon in the tool- 
bar of the working window. 


If an online connection to the CPU has not yet been established, STEP 7 searches for 
accessible devices. If necessary, set the LAN adapter used in the programming de- 
vice in the dialog window Go online, select the PLC station found, and click on the 
Go online button. 


To switch off the program status, click again on the Monitoring on/off icon in the 
toolbar. You will be asked whether the online connection which was created when 
switching on the program status is to be canceled. If you click on the No button, the 
program status will be exited but the online connection remains established. 


Display format with digital tags 


The display format of digital tags is set as standard to Automatic, but you can 
change it by selecting the digital tag and then Modify > Display format >... from the 
shortcut menu. ... > Decimal, ... > Hexadecimal, and ... > Floating-point are possible. 


In the case of LAD and FBD you set the display format for the complete network if 
you click with the right mouse button on a free space in the network and then select 
Modify > Display format for network > ... from the shortcut menu. 


Controlling operands in the program status 


In the program status you can use the programming device to define the signal 
states of binary tags and the values of digital tags. This is usually only meaningful 
if these tags cannot be controlled from another position, for example as is the case 
with inputs which receive their signal state from the peripheral input channel 
during the automatic updating of the process image. 


Select the tag and then the Modify > Modify to 0 command from the shortcut menu 
if the binary tag is to be set to signal state “O” or Modify > Modify to 1 if the binary 
tag is to be set to signal state “1”. In the case of digital tags, select the Modify > Mod- 
ify operand... command from the shortcut menu and specify the desired value. 


Block calls in the program status (LAD, FBD) 


If the tested network contains a block call, the call box is represented by green con- 
tinuous lines if the EN input is “1”. The box has blue dashed lines if the EN input 
is a Oa 


You can move on to the called block and continue the program status there: Select 
the block call and then the Open and monitor command from the shortcut menu. 
The program status then changes to the called block. 
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Program status in LAD representation 


In the LAD program status, green continuous lines are used to identify contacts, 
coils, and the connections between the program elements which have signal 
state “1”. Program elements with signal state “0” are identified by blue dashed 
lines (Fig. 15.7). 


39 
#Distance_ 
counter 


132.0 M1506 499.7 cu 
“Enable” “Workpart tensed” “Clock 10 HZ Int 


39 
“EMW9 6 

39 — “Distances* 
AMIS 6 

“Distances” 


Fig. 15.7 Program status in LAD representation 


Program elements with unknown status or those which are not processed are iden- 
tified by continuous gray lines. Tags shown in black mean that the displayed value 
is from the current monitoring cycle, those in gray display a value from a previous- 
ly processed cycle. 


You can determine at which position the program status is to be executed: Select 
the program element or tag and then the Modify > Monitor from here command 
from the shortcut menu. The Modify > Monitor selection command from the short- 
cut menu means that only the selected program element is monitored. 


Program status in FBD representation 


In the FBD program status, green continuous lines are used to identify the boxes of 
the binary program elements and the connections if they have signal state “1” and 
blue dashed lines if they have signal state “0” (Fig. 15.8). In addition to the colored 
identification, the signal status (TRUE or FALSE) is displayed for the binary inputs. 


Program elements with unknown status or those which are not processed are iden- 
tified by continuous gray lines. Tags shown in black mean that the displayed value 
is from the current monitoring cycle, those in gray display a value from a previous- 
ly processed cycle. 


You can determine at which position the program status is to be executed: Select 
the program element or tag and then the Modify > Monitor from here command 
from the shortcut menu. The Modify > Monitor selection command from the short- 
cut menu means that only the selected program element is monitored. 
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Fig. 15.8 Program status in FBD representation 


Program status in STL representation 


The program status is shown in tabular form next to the statements so that the tag 
value can be read for each statement line. The RLO column shows the result of logic 
operation: “0” has a purple background and “1” has a green background. The Value 
column shows the current status or the current value of the operand. The Extra col- 
umn shows additional information, for example the assignment of the overflow bits 
with arithmetic operations (Fig. 15.9). 


You can use the Absolute/symbolic operands icon to select the displayed type of 
addressing. 


RLO Value Extra 
1 A “Enable” $M32.0 — = ests—‘—SsCOY 
2 AN “Workpart tensed" $M50.6 1 S| 
3 AR "Clock 10 Hz" $M99.7 1 
4 = #temp_bool 1 1 
5 L “Distances” SMHI96 — Cl estsisdY 
‘ La i °° | 
7 >=I _—SS—ESSS SSS 
8 = #temp_bool 2 is) 
9 CALL #Distance_counter In Out 
10 Int 
11 CU :=#temp_bool 1 TRUE 
12 R :=#temp_bool 2 FALSE 
13 PV :=0 it) W#1620 
14 Q == 
5 CV :="Distances” SMW96 W#16#27 


ay 


t 
1 


Fig. 15.9 Program status in STL representation 
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Program status in SCL representation 


The program status is shown in tabular form next to the statements. The line in the 
table contains the name and value of the (first) tag in the statement line. If the state- 
ment line contains several tags, a table with all tags is displayed when you position 
the cursor in the statement line. 


If the line contains one of the IF, WHILE, or REPEAT statements, the result of the con- 
dition (TRUE, FALSE) is shown in the line. 


You can use the Absolute/symbolic operands icon to select the displayed type of 
addressing. If the tag name is shown in gray, the corresponding program is not pro- 
cessed. 


If no value can be shown for a tag or event, the table contains three question marks 
on a yellow background in the Value column. In this case, activate the Create extend- 
ed status information attribute in the block properties and load the block again into 
the CPU (Fig. 15.10). 


1 H#Distance_counter (CU:="Enable” "Enable" S| 
2 AND NOT "Workpart tensed” “Workpart tensed” FALSE 
3 AND "Clock 10 Hz", "Clock 10 Hz" TREE 
4 R:="Distances” > 42, "Distances" SS36S 
5 PV:=0, 

6 CV=>"Distances"); “Distances” Sia 


Fig. 15.10 Program status in SCL representation 


15.5.4 Testing in single step mode 


In the programming languages STL and SCL, you can test the program statement 
by statement in single step mode. The CPU is in the HOLD state in this case; the 
peripheral outputs should be switched off as a precaution. You can use breakpoints 
to stop the program at any desired position and test step-by-step. 


Set breakpoints 


You set the breakpoints for testing in single step mode in the program of the offline 
block. Click with the right mouse button at the beginning of the line in the gray ar- 
ea in front of the line number in which you wish to set a breakpoint and then select 
the Set breakpoint (STL) or Breakpoints > Set (SCL) command from the shortcut 
menu. Alternatively, double-click on the gray area. The breakpoint is then set and 
displayed on the Testing task card in the Breakpoints pallet. 


You can set any number of breakpoints, but only activate one of the quantity which 
depends on the CPU for testing. 


Breakpoints are not saved. If the project is closed, the breakpoints are lost. 
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Moving to a breakpoint 


In order to move to a breakpoint, double-click in the Breakpoints pallet on the 
breakpoint you wish to move to, or click on it with the right mouse button and select 
the Go to breakpoint command from the shortcut menu. 


In order to move from one breakpoint to another, select (with the block open) the 
Online > Breakpoints > Next command in the main menu if the next breakpoint is to 
be jumped to, or Online > Breakpoints > Previous if the previous breakpoint is to be 
jumped to. 


Activate breakpoints 


The breakpoints must be activated to enable testing. Note that the single step func- 
tions “Step over”, “Step into” and “Run to cursor” also count as breakpoints. These 
functions can no longer be executed if the maximum number of breakpoints is acti- 
vated. 


When activated, the breakpoint is transferred to the CPU. Program execution is car- 
ried out in RUN mode up to the first active breakpoint and then stops in HOLD 
mode. The STOP LED lights up permanently and the RUN LED flashes. 


Caution! When testing in single step mode, the CPU if switched to HOLD mode during 
ongoing operation on the process. Make sure that no damage to property or injury to 
persons can occur! 


You activate a specific breakpoint by selecting it in the program code or in the 
Breakpoints pallet and then the Enable breakpoint command from the shortcut 
menu. Alternatively; you can activate all breakpoints together in the Breakpoints 
pallet with the drop-down list under the Actions for all breakpoints icon. 


Switching-on of test mode mode must be confirmed in a dialog window if it is not 
already switched on. 
Status display 


In the task window on the Testing task card in the PLC register pallet, you can mon- 
itor the values of the status bits and the CPU registers for the statement line at 
which program execution has stopped. All status bits, the accumulators, the ad- 
dress registers, and the data block registers are displayed. 


Testing in single step mode 


You can select the functions for testing in single step mode in the shortcut menu 
which you call up in the gray area in front of the line number or by clicking the cor- 
responding icons in the Breakpoints pallet (Fig. 15.11). 
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~ | Breakpoints The icons from left to right: 
z +e @oeugiwae Actions for all breakpoints 
A test mode (Remove/Enable/Disable breakpoints) 


Set/delete breakpoint 
Enable/disable breakpoint 
Run 

Run to cursor 

Step over 

Step into 

Step out 


Fig. 15.11 Icons in the Breakpoints pallet 


You can continue program testing in the following ways: 


> 


Run 
Continue program execution at normal processing rate up to next active break- 
point. 


Run to cursor 
Continue program execution at normal processing rate up to the statement 
selected by the mouse pointer. 


Step over 
The currently selected statement is executed, a switch is made to the next state- 
ment and then stopped. 


Step into 
Call of a subordinate block and continuation of program execution in the called 
block. 


Step out 
Continuation of program execution in the called block if the program execution 
in the called block was interrupted at a breakpoint. 


Upon each stop, the PLC register pallet shows the current assignment of the status 
bits and the CPU registers. 


If the online connection is canceled, all breakpoints are deactivated. You will be 
informed in this case that the CPU then returns to RUN mode. 


Exit single step mode 


To exit single step mode, you disable and remove the breakpoints — for example in 
the Breakpoints pallet using the Actions for all breakpoints icon — and deactivate the 
Test mode checkbox. The Enable output in RUN checkbox must be activated. 


Subsequently click with the right mouse button in the gray column in front of the 
line number and select the Run command from the shortcut menu. The CPU then 
goes to RUN mode. 
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15.5.5 Monitoring of PLC tags 


To monitor with the tag table, double-click on the PLC tag table in the project tree. 
Click the Monitor all icon in the toolbar. The PLC tag table changes to online mode 
and the Monitor value column is displayed. You can now monitor the tag values. 


The current time and count values are displayed with the SIMATIC timer functions 
(data type TIMER) and the SIMATIC counter functions (data type COUNTER). 


Fig. 15.12 shows an online PLC tag table where monitoring is activated. The Acces- 
sible from HMI, and Visible in HMI columns which are no longer required are hid- 
den. 


Project400 » Distribution control [CPU 412-2 PN] >» PLC tags >» Conveyor_belt [36] 


Tags | © User constants 
2 @ Flix 5 
Conveyor_belt 
Name Data type Address Retain Monitor value Comment 
12 | Istop Bool 410.3 iS 
3 | -@ Start Bool 610.4 Mme — Start botton on the operator panel 
14 @ Continue Bool %610.5 Continue botton on the control panel 
15 <@ Acknowledge Bool 610.6 Mme Acknowledge from the operator panel 
16 «(|< Set Bool %10.7 GrAse Set signalfrom operator panel 
17) Display fault Bool %Q8.0 Mme Fault indication on the operator panel = 
18 =< Display ready Bool %Q8.1 Mme Indicator "Ready" on the operator panel = 
19 << Belt motor? Bool %Q8.2 Mme Switch_on conveyor belt 1 
20 << Belt motor3 Bool %Q8.4 Switch_on conveyor belt 3 
21 <@] Belt motor 4 Bool %Q8.5 GrAse Switch_on conveyor belt 4 
22 <Q Ready for load Bool %M42.0 Conveyor belt is ready for load 
23 (4) Ready for remove Bool %M42.1 Workpieces can be removed 
24 <<] Number pieces Int elds (PEs == | Number of workpieces 
25 <Q Supenision Timer TZ ‘SSTROMS Monitoring time 
26 << Manual mode Bool %M40.0 GraAse Manual mode 
27 Automatic mode Bool %M40.1 Automatic mode 
28 <<] Number counter Counter %C11 (#123 Counter for workpieces lea 
< tm | |> 


Fig. 15.12 Monitoring with the PLC tag table 


15.5.6 Monitoring of data tags 


To monitor the data tags, you open the data block, for example with a double-click 
in the project tree, and click on the Monitor all icon in the toolbar of the working 
window. The Monitor value column with the current values of the data tags is 
displayed. A further click on the Monitor all icon exits monitoring mode. 


You can “freeze” the monitor values. With monitoring mode switched on, click on 
the Snapshot of the monitored values icon in the toolbar of the working window. A 
new column Snapshot with the currently present monitor values is displayed. 


Fig. 15.13 shows the monitoring function for a data block in expanded mode. The 
combined tags are “opened” so that the individual values can be monitored. Col- 
umns which are not required, for example Default value, Retain, and Visible in HMI, 
can be hidden. The Snapshot column is not shown in the figure. 
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Peete ToT = 
Belt data 
Name Data type Offser Szart value Manos value 4 
Oo State i 
2 48 ~ Quantty Astay [1 _ 4) of int oo 
> a4 = Quenticy{t] int ° 
iad . Quenvey{2] int 5 
a . Quantity{3] int 
a .- Quentityis] im 
Qs © Power Aeray[t 4] of Real a0 
a . Power[1} Real 312 
“a 8 Poweri2] Reel 12 
eee | . Power|3} Real 34 
a . Power|4} Rea! 32 
12 <4] 5 © Monitoring Array [1 _ 4] of SSTime 24.9 
nag . Menitoring[ 1} $STime §5e85s 
‘a . Monitormng[2} S5Tirne S5TeSs 
na 58 Monitoring[3] SStime $oT82.85 
a . Menitoring|4]} SStime 551s3 3s 
om. Start signal Bool 32.0 
16 <4] 6 Stop Bool 32.1 
*Qe initial state Bool 322 
< ~ 


Fig. 15.13 Example of monitoring of data tags 


Please note that tag values displayed in monitoring mode can originate from differ- 
ent program cycles. 


15.5.7 Testing with watch tables 


The watch tables contain tags whose values can be monitored and controlled 
during runtime. The tags can be combined in any manner so that a specially tai- 
lored watch table can be created for each test case. You can call the test functions in 
the shortcut menu or using the icons in the toolbar of the working window shown 
in Fig. 15.15 on page 624. 


Tags from data blocks (global, instance and type data blocks) can be used in watch 
tables as well as tags from the areas: peripheral inputs/outputs, inputs, outputs, and 
bit memories. The current time and count values are displayed with the SIMATIC 
timer functions (data type TIMER) and the SIMATIC counter functions (data type 
COUNTER). 


In the case of a CPU 400, you can simultaneously monitor and control up to 70 tags. 


Creating a watch table 


Underneath a PLC station in the project tree there is the Watch and force tables fold- 
er with the watch tables. Further subfolders can be created within this folder in or- 
der to structure the watch tables: Select the Watch and force tables folder and then 
the Add group command from the shortcut menu. You can assign separate names 
to the new subfolders and the watch tables by using the Rename command from the 
shortcut menu. 
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Project400 > Distribution control [CPU 412-2 PN] > Watchand force tables > Distribution control 


ie 
Address Display format Monitor value Monitor with trigger Moc 
1 "IStop™ %10.3 Boo! Gratse Permanently, at startofscancycle Perna 
2 “Start” 610.4 Bool Mme Permanently, at start of scan cycle Pert =| 
3 “Acknowledge” 10.6 Bool TRUE Once only, at start of scan cycle Perr 
4 ‘%IBO:P Bin 2#0000_0000 Once only, at start of scan cycle Perr 
5 “Display fault” %Q8.0 Boo! Mme Permanently, atend ofscancycle Perr 
6 “Belt motor 1° E}} %Q8.2 Boo! [-|/M@mue =| Permanently, at end of scan cycl w | Perr 
ri - %QBB:P Bin 3 Permanent 
8 “Number pieces* Mad DEC signed ———aa Permanently, at start of scan cycle 
Once only, at start of scan cycle 

9 “Supervision® %T12 SIMATIC Time FEMME rermanentyatendofscanocle 
10 “Light barrier 1" %6M41.0 Boo (FALSE | Once only, at end of scan cycle 
"1 “Belt_1" Load %DB101.DBX6.0 —_Boo! Grase anger piceeriesiops aad 
12 “Belt_1".Ready forload  %DB101.DBX4.0 _Bool GFAlse = Permanent FET] 
13 “Belt_1* Quantity %DB101.DBW8 DEC_signed ie] Permanent Perr 
14 “Belt_1*.Power %DB101.DBWI0 —- DEC_signed ‘0s Permanent Pert 
15 “Manual mode* %IM40.0 Bool Permanent Perr 
16 “Number counter” %C11 Counter #1230 Permanent Pert ¥ | 

[<] tit } >] | 


Fig. 15.14 Example of monitoring of tags in expanded mode 


In order to create a new watch table, double-click on the Add new watch table com- 
mand. In the empty table, enter the names of the tags line by line and the display 
format from a drop-down list. You can enter a short explanatory text for each tag in 
the comment column. 


The tags entered with names must previously have been defined in the PLC tag table 
or in a data block. You can also enter the memory location (absolute address) in the 
Address column. 


Fig. 15.14 shows monitoring in expanded mode. In the Monitor with trigger column, 
the possible settings are “opened”. 


Monitoring and modifying with triggers 


The watch tables permit specification of the monitoring and control time. The fol- 
lowing can be selected: 


> Permanent 
In each program cycle the inputs are monitored and controlled at the start of the 
cycle prior to processing of the main program and the outputs at the end of the 
cycle following processing of the main program. 


> Permanently, at start of scan cycle 
In each program cycle, the tags are monitored and controlled prior to processing 
of the main program (meaningful for inputs or tags which control functions). 


> Once only, at start of scan cycle 
The tags are monitored and controlled once prior to processing of the main pro- 
gram (meaningful for inputs or tags which control functions). 


> Permanently, at end of scan cycle 
In each program cycle, the tags are monitored and controlled following process- 
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ing of the main program (meaningful for outputs or tags which are controlled by 
functions). 


> Once only, at end of scan cycle 
The tags are monitored and controlled once following processing of the main 
program (meaningful for outputs or tags which are controlled by functions). 


> Permanently, at transition to STOP 
The tags are monitored and controlled permanently at the transition to the STOP 
state. 


> Once only, at transition to STOP 
The tags are monitored and controlled once at the transition to the STOP state. 


It is additionally possible to control tags using the Online > Modify > Modify now 
command in the main menu or the Modify > Modify now command in the shortcut 
menu. The selected tags are then updated as rapidly as possible. Tags can even be 
controlled using the listed commands if the CPU is in the STOP state. 


Monitoring of tags with watch table 


You can call the test functions of a watch table in the shortcut menu or using the 
icons in the toolbar of the working window shown in Fig. 15.15. 


ly. % B/S 

The icons from left to right: 

Name in text Tooltip text 

Basic mode Showlhide all modify columns 

Expanded mode Show/hide advanced setting columns 

Modify now Modify all selected values once and now 

Modify with trigger All active values will be modified by “modify with trigger” 

Enable PQ The function “Enable peripheral outputs” disables the output disables (OD) 
Monitor all Monitor all 

Monitor now Monitor all values once and now 


Fig. 15.15 Icons in the toolbar of the watch table 


Double-click to open the watch table and select Monitor all or Monitor now. An online 
connection to the CPU will be established. 


In basic mode, the Name, Address, Display format, Monitor value, and Comment col- 
umns are displayed. The Monitor value column shows the tag value in the display 
format which has been set in the Display format column. If Monitor now was select- 
ed, Monitor value shows a snapshot; if Monitor all was selected, the values in the 
Monitor value column are updated continuously. 


The time of monitoring corresponds to the trigger mode Permanent (see 
“Monitoring and modifying with triggers” on page 623). You can stop the current 
monitoring by clicking again on the Monitor all icon. 


Please note that peripheral outputs can never be monitored. 
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Monitor with trigger 


In expanded mode, you can select the trigger time at which the tag values are read 
from the CPU. If you switch on the Expanded mode function, the Monitor with trigger 
column is displayed. You can then define the read time for each tag from a drop- 
down list. 


Tag values which are read out once only or which are not read out (yet) are shown 
in the Monitor value column with a gray background; permanently read values have 
an orange background. 


Controlling of tags with watch tables 


Double-click to open the watch table and switch the Expanded mode function on. In 
addition to the Name, Address, Display format, Monitor value, and Comment col- 
umns, the Modify value and Tag selection (represented by a lightning icon) columns 
are now displayed. 


In the Modify value column, enter the value to which the tag is to be set; in the 
Tag selection column, activate the checkbox if the associated tag is to be modified. 
A yellow triangle with exclamation mark indicates that the selected tag has not yet 
been modified. 


It is recommendable to switch on permanent monitoring prior to the modification. 
An online connection to the CPU is then already established and the success of the 
modification can be monitored. 


Caution! Make sure that no dangerous states can occur when modifying tags! 


To modify the activated tags, click on Modify now. The tags activated in the Tag se- 
lection column are immediately set (as fast as possible) to the control value. If a tag 
is immediately overwritten after the modification by a value from the program - for 
example if a switched-on input has been controlled to “0” and the process image up- 
dating overwrites the control value again — the yellow triangle appears again in the 
Tag selection column. 


In Fig. 15.16, the tags “Belt motor_1”, “Quantity_parts”, “Monitoring” (the time value 
of the SIMATIC timer function) and “Belt_1”.Quantity have been selected for modifi- 
cation. 


Alternatively, modification can be triggered by means of the Online > Modify > Mod- 
ify now command from the main menu or the Modify > Modify now command from 
the shortcut menu. The Modify > Modify to 0 and Modify > Modify to 1 commands 
from the shortcut menu immediately control the tag selected in the watch table. 


Please note that peripheral inputs can never be modified. 


Only the tags visible in the table are modified. Multiple modification (multiple 
input) of a tag in the watch table is not permissible. 


Caution! Reloading of modified data blocks with an ongoing control job can result in 
unforeseen operating states. The control job continues to modify the specified address, 
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Pits Ae PS 
i Name Address Ouplay format Modity valve ? Cort 
"Stop" 03 Bool a! 
“Star s204 Beal Tue 0 lal 
: * Acknowledge” mI06 Bool uF is 
1 ~eOP Bin 290000_1000 % 
"Display foulr” %06.0 Bool FALSE 4h 
- "Belt motor 1" 308.2 Bool 
nQCEr Bin 280000_0101 0 
“number pieces* MS DEC_signed 1 en 
“Supervision” %TI2 SIMATIC Time SSTs 12006 Mt 
“Light barmer 1° SME1O Bool 
“telt_1" Loed 08101 DEXE.0 Bool 
“Belt_1° Ready _for_load 9.08101 DAK4 0 Bool 
3 “Belt_1"_Quennty @) %OB101.DEN8 DEC_signed ) Me 
™ “Belt_1" Power 00101 Dewo DEC signed ¥ 
5 “Manual mode“ 560.0 Bcol 
16 “Number counter” CII Counter C#123 ry Pry | 
| < rs > | 


Fig. 15.16 Example of controlling tags 


while the address assignment in the data block may possibly have changed. Exit ongo- 
ing control jobs prior to the loading of data blocks. 


Modify with trigger 


In expanded mode, you can select the trigger time at which the tag values are mod- 
ified in the CPU. If you switch on the Expanded mode function, the Monitor with trig- 
ger and Modify with trigger columns are displayed. You can then define the control 
time for each tag from a drop-down list. 


If you click Modify with trigger, all activated tags are updated (following confirma- 
tion) with the control value in accordance with the trigger conditions. Clicking on 
the icon again exits permanent control. 


Alternatively, modification can be triggered or exited by means of the Online > 
Modify > Modify with trigger command from the main menu or the Modify > Modify 
with trigger command from the shortcut menu. 


Modify now 


You can use the Modify now function to assign values once to tags independent of 
the monitoring and control modes. This job is executed as rapidly as possible. With 
the CPU at STOP, this command can be used to assign default values to tags. 


Enter the modify values in the watch table and activate the checkbox after the mod- 
ify value in the column in which the tag to be controlled is present. A yellow triangle 
indicates that this tag has been selected for modification but has not yet been 
controlled. 


To carry out the modification, select the Online > Modify > Modify now command in 
the main menu or shortcut menu. 
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15.5.8 Enable peripheral outputs 


In STOP state, the output modules are normally disabled by the OD signal (com- 
mand output disable); the Enable peripheral outputs function can be used to switch 
off the BASP signal so that you can also control the output modules with the CPU at 
STOP. Controlling is carried out using a watch table. An application for this would 
be checking the wiring of the outputs in the STOP state and without a user program. 


Caution! Make sure that no dangerous states can occur with “Enable peripheral 
outputs”! 


Prerequisite for Enable peripheral outputs: An online connection exists to the CPU 
which is in the STOP state. A watch table with the peripheral outputs to be con- 
trolled has been created and expanded mode is switched on. Exit all force jobs (see 
Chapter 15.5.9 “Testing with the force table” on page 628)! 


You can call the test functions in the shortcut menu or using the icons in the toolbar 
of the working window shown in Fig. 15.15 on page 624. 


Open the watch table, switch on the Expanded mode function, enter the control 
value in the Modify value column, and activate the selection checkbox. You switch 
off the command output disable (OD) for the output modules using Enable PQ. 
You can now modify the tags using Modify now. Alternatively you can use the 
Online > Modify > Enable peripheral outputs and Online > Modify > Modify now com- 
mands from the main menu. 


In Fig. 15.17, the operand %QB8:P (peripheral output byte 8) has been selected for 
the Enable PQ function. “Bin” has been selected as the display format in order to be 
able to control each bit individually. The icon in the Monitor value column indicates 
that the signal state of peripheral outputs cannot be monitored. 


a 


v\ts| % ws 
i Nome Address Display formar Monitor velue . Modity value ? ‘ 
"Stop" 103 Bool ;) A 
“Start w4 Bool ] 
“Acknowledge” 0.6 Bool 
<B0F Bin * 

“Oispley foul” 508.0 Bool 
*Belt motor 1° 4052 Bool 

ig) NOBEP Bin =) 2#0000_0101 M4 it 
“Number pieces” SS OFC_signed 
“Supervision” STI? SIMATIC Tene 
“Ught bamer 1~ WTO Bool 
“Bek_1" Load %DB 101 DEX6.0 fool 
“Belt_l" Ready_for_joad %DB101 DaKs 0 Bool 
“Beh_1}” Quantity SDBI01 DewWsS DEC_signed 
“Bek_l" Power %DBI0) DEWIO DEC signed 
*Menwel mode” SMK00 Scol 
"Number counter” “C11 Counter 


Fig. 15.17 Example of enabling peripheral outputs 
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You can then control the peripheral outputs for as long as Enabled peripheral 
outputs is switched on. 


You deactivate the Enable PQ function — the BASP signal is then switched on again - 
by selecting the Enable PQ function again, by changing the CPU mode, or by cancel- 
ing the online connection. 


15.5.9 Testing with the force table 


Tags can be preassigned fixed values. This action is referred to as “forcing”. 
ACPU 400 can force tags from the peripheral inputs and peripheral outputs area. 


The maximum number of tags controlled with the force job depends on the CPU 
used. Forcing is then only possible if the Enable peripheral outputs function is 
switched off. 


Please note: Forcing is sent to the CPU by means of a force job. The force job remains 
active even if online mode is terminated and the online connection to the program- 
ming device canceled! The force job also remains active after switching the CPU off and 
on! Forcing can only be exited using the Force > Stop forcing command; this com- 
mand deletes the force job in the CPU. 


With the force table you can force peripheral inputs and peripheral outputs in the 
data formats BYTE, WORD, and DWORD. You can monitor tags from the inputs, 
outputs, bit memories, and data tags operand areas as well as peripheral inputs. 
The force table is present once for a CPU and cannot be copied or renamed. A re- 
quirement for using the force table is an open project with an associated CPU. 


Filling a force table 

Open the force table by double-clicking in the project tree in the “Watch and force 
tables” folder. 

In the empty table, enter the names of the tags line by line and the display format 


from a drop-down list. The display format may differ from the data type of the tag. 
You can enter a short explanatory text for each tag in the comment column. 


The tags entered with names must previously have been defined in the PLC tag table 
or in a data block. You can also enter the memory address (absolute address) in the 
Address column. 


Monitoring tags in the force table 


The entered tags can be monitored. The Expanded mode icon in the toolbar of the 
working window opens the Monitor with trigger column. You can set the monitoring 
conditions here. You start monitoring by clicking on the Monitor all symbol (refer 
to Chapter 15.5.7 “Testing with watch tables” on page 622 for details). 


Forcing with the force table 


You can call the test functions when forcing from the shortcut menu or using the 
icons in the toolbar of the working window shown in Fig. 15.18. 
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Bo | FL Fa 9S 4 


The icons from left to right: 


Name in text Tooltip text 

Expanded mode Show/hide advanced setting columns 

Start forcing Starts or replaces forcing of the visible addresses in the Force table 
Stop forcing Stop forcing of the selected addresses 

Monitor all Monitor all 

Monitor now Monitors all values once and now 


Fig. 15.18 Icons in the toolbar of the force table 


To carry out forcing, enter a value in the Force value column and activate the check- 
box in the Force column (tag selection). A yellow triangle with exclamation mark 
indicates that the selected tag has not yet been forced. 


It is recommendable to switch on monitoring mode prior to forcing. An online con- 
nection to the CPU is then already established and the success of forcing can be 
monitored. 


Caution: Make sure that no dangerous states can occur when forcing tags! 


The Start forcing icon sends a force job to the CPU which contains the tags selected 
for forcing. Forcing is effective immediately (Fig. 15.19). The FRCE LED on the CPU 
lights up when a force job is active. 


Project400 > Distribution control [CPU 412-2 PN] > Watch and force tables > Force table 


i Name Address Display format Monitor value Force value F Comment 
TER *start* 2610.4 Bool ENFALSE ln 
2 \E) = “Istop* 3610.3 Bool (E)FALSE [Z| 
3 FE) = “Display fault” %Q8.0 Bool (EyTRUE 
4 Eh “Display ready” %Q8.1 Bool EQTRUE 
5 {| sIBOP Bin [=][B52#0000_0000 2#0000_0000 [| & | 
6 %QB8P Bin a 2#0000_0011 
7 "iMotor fault 1" — %M41.1 Bool Grase a 
< tl [>| 


Fig. 15.19 Example of forcing of peripheral inputs and outputs 


To exit forcing for individual tags, deactivate the checkbox in the tag selection and 
click on the Start forcing icon again. A new force job is sent to the CPU which termi- 
nates forcing for the tags which are no longer selected. 


You exit forcing for all tags using the Stop forcing icon. A new force job is then sent 
to the CPU, which terminates forcing for all forced tags. 


Note that termination of forcing leave the tags in their last state! Only the force job is 
deleted. For example, an output of a digital module remains in signal state “1” after 
termination of forcing if it is not controlled otherwise by the program. 
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As an alternative to forcing using the icons, you can select one or more tags in the 
force table and then the Force > Force to 0, Force > Force to 1, Force > Force all, and 
Force > Stop forcing commands from the shortcut menu or the commands from the 
main menu under menu item Online > Force > .... 


The FRCE LED on the CPU turns off when no more force jobs are present in the CPU. 
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16 Distributed I/O 


16.1 Introduction, overview 


Distributed I/O is the term used for input/output modules connected to the central 
PLC station over a bus system. SIMATIC S7 uses the bus systems PROFIBUS DP, 
PROFINET IO, and for S7-300 also the actuator/sensor interface. 


The distributed I/O is handled like the central I/O. The distributed inputs/outputs 
are in the same address volume as the central inputs/outputs, and therefore the 
addresses of the distributed I/O must not overlap with those of the central I/O. The 
distributed I/Os can be addressed via the following operand areas: peripheral 
inputs (I:P) and peripheral outputs (Q:P) and - if they are present in the process 
image - also via the inputs (I) and outputs (Q). 


Transfer between the distributed modules and the central CPU is carried out 
“automatically” and you need not take this into account when addressing. 


Data transfer to and from the distributed I/O is controlled from a central point: With 
PROFIBUS DP it is the DP master and with PROFINET IO it is the IO controller. The 
distributed stations — these are the DP slaves with PROFIBUS DP and the IO devices 
with PROFINET IO - are the passive partners in the data transfer. 


S7 stations and ET200 stations with a CPU can also be used as distributed I/O sta- 
tions and these are then “intelligent” DP slaves or IO devices. While these stations 
are controlling their own modules (considered from their viewpoint as central 
modules), they also satisfy - when working at the same time as DP slaves or IO de- 
vices — the data requirements of the respective DP master or IO controller. 


The distributed I/O is configured using the hardware configuration. PROFIBUS DP 
and PROFINET IO are configured as subnet. The connections required for data 
transfer are then present “automatically”. 


Network transitions between the subnets can be produced using link and coupler 
modules which allow data exchange between the stations connected to the various 
networks. 


The programming device is able to handle programming and servicing functions 
over PROFIBUS DP and PROFINET IO. It can reach all (“intelligent”) stations connect- 
ed to the subnets if the subnet gateways are present in stations with routing capa- 
bility. 
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16.2 ET 200 distributed I/O system 


ET 200 is the device family for the distributed I/Os on PROFIBUS DP and 
PROFINET IO. Depending on their use locally on the machine or in the process, the 
mechanical properties can be highly different, especially the degree of protection: 
IP 20 for installation in a control cabinet and IP 65 for mounting directly on the ma- 
chine. 


The range of ET 200 stations extends from a simple compact station practically cor- 
responding to an I/O module, to a station with modular design and several mod- 
ules, up to the “intelligent” station which can execute a user program with its own 
CPU. 


16.2.1 ET 200L 


ET 200L is a very small and compact I/O 
device with degree of protection IP 20 
and is preferably used for the lower 
performance range and where only 
limited space is available. 


The maximum data transfer rate on the 
PROFIBUS is 1.5 Mbit/s. ET 200L con- 
sists of a terminal block to which the 
wiring is connected and an electronics 
block containing the digital inputs and Fig. 16.1 ET 2001 for PROFIBUS DP 
outputs. ET 200L is available with 16 or 

32 channels and cannot be expanded. 


The ET 200L with 16 digital inputs is also available in a hardened SIPLUS version. 


16.2.2 ET 200M 


ET 200M is a modular I/O system with 
degree of protection IP 20 and is partic- 
ularly suitable for individual and com- 
plex automation tasks. Depending on 
the interface module, up to 8 or 12 
modules from the $7-300 range can be 
used (the High-Feature version also al- 
lows the use of function and communi- 
cation modules). 


The internal bus signals are passed on __ Fig. 16.2 ET 200M with IM 153-4 PN 
from module to module over a bus con- 

nector. If active bus modules are used 

onto which the modules are snapped, 

the latter can be replaced during ongoing operation. 
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The maximum data transfer rate on the PROFIBUS DP is 12 Mbit/s and 10 or 
100 Mbit/s on the PROFINET IO. With the integral 2-port switch, a linear topology 
can be implemented with the ET 200M as IO device without external devices. 


The ET 200M is also available in a hardened SIPLUS version and can be used with 
S7-300 modules with the same properties in environments with increased de- 
mands. 


ET 200M can also be used in fault-tolerant systems for redundant operation. The 
fail-safe S7-300 modules can be used in the ET 200M - also mixed with standard 
modules. Together with Ex digital and analog modules, intrinsically-safe sensors 
and actuators can be connected from zones 1 and 2 of hazardous plants. 


16.2.3 ET 200S 


ET 200S is a versatile I/O system with 
degree of protection IP 20 whose 
bit-modular design allows exact adap- 
tation to the automation task. Digital 
input/output modules, analog in- 
put/output modules, technology mod- 
ules, motor starters, and frequency 
converters are available. Up to 63 I/O 
modules can be connected to the 
ET 2008S interface module. The I/O mod- 
ules can be replaced during ongoing 
operation; they are snapped onto ter- 
minal modules which contain the wir- Fig. 16.3 ET 2008S with IM 151 CPU 

ing. ET 2008S is available with a 

PROFIBUS DP interface (maximum data transfer rate 12 Mbit/s) or a PROFINET IO 
interface (maximum data transfer rate 100 Mbit/s). 


Together with the IM 151-7 CPU interface module, ET 200S can be used as a mini 
PLC. In association with the DP master module, the IM 151-7 CPU also has DP mas- 
ter functionality. The PLC functionality corresponds to that of a CPU S7-314. 
ET 2008S with the IM 151-8 PN/DP CPU interface module can additionally be operated 
as an IO controller on PROFINET IO. 


ET 200S is available with integral safety technology, where standard modules and 
fail-safe modules can be used together. A fail-safe mini PLC can be implemented 
using the IM 151-7 F-CPU interface module and the S7 Distributed Safety option 
package. 


The ET 200S is also available as a PROFIBUS DP slave with digital inputs and outputs 
in a hardened SIPLUS version. 


ET 200S COMPACT is a range of interface modules with onboard I/O, either with 32 
digital inputs or with 16 digital inputs and outputs. Up to 12 ET 200S I/O modules 
(except F modules) can be connected to these interface modules so that a station 
can have up to 128 channels (mixed digital and analog). 
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ET 2008S can also be used in fault-tolerant systems downstream of a Y-link (bus cou- 
pler for transition from a redundant to a single-channel PROFIBUS DP). 


16.2.4 ET 200iSP 


ET 200iSP is an intrinsically-safe I/O 
system with degree of protection IP 30 
for use in hazardous gas and dust 
areas, i.e. in zones 1 and 2 as well as 21 
and 22, with connection of intrinsical- 
ly-safe signals from zones 0, 1 or 2 and 
20, 21, or 22. 


ET 200iSP consists of a power supply 
module, an interface module, and up to 
32 electronic modules for digital and 
analog inputs/outputs. The modules 


Fig. 16.4 ET 200iSP with redundant IM 152-1 


are snapped onto terminal modules and can be replaced during ongoing operation. 


The bus line must also have an intrinsically-safe design in order to operate an 
ET200iSP intrinsically-safe. This is achieved using an RS 485-IS coupler as isolating 
transformer. The maximum data transfer rate is 1.5 Mbit/s. ET 200iSP can also be 
used in redundant mode in fault-tolerant systems. 


16.2.5 ET 200R 


ET 200R is available as a handling or 
welding module with IP 65 degree of 
protection in a metal enclosure for en- 
vironments with high electromagnetic 
interference. The module has 16 
channels, of which 8 channels are digi- 
tal outputs and 8 channels can be indi- 
vidually parameterized as digital in- 
puts or outputs. The maximum data 
transfer rate on the PROFIBUS is 12 
Mbit/s. 


16.2.6 ET 200eco 


ET 200eco with degree of protection 
IP 65/67 is the low-cost solution for pro- 


Pos! ase) 
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Fig. 16.5 ET 200R (left) and ET 200eco with 
ECOFAST connection 


cessing digital signals at machine level. ET 200eco comprises a basic module and a 
connection block of different designs. Modules are available with 8 or 16 digital in- 
puts, 8 or 16 digital outputs, 8 digital inputs and outputs each, and in fail-safe ver- 


sions with 4 or 8 digital inputs. 
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The maximum data transfer rate on PROFIBUS is 12 Mbit/s. During commissioning 
and servicing, the modules can be disconnected interruption-free from the 
PROFIBUS and reconnected. 


ET 200eco PN is the compact block I/O for processing digital, analog and IO-Link sig- 
nals for connection to the PROFINET IO bus system. The design of the digital input 
and output modules is as with the PROFIBUS version of ET 200eco. Additionally 
available are an analog input module with 8 channels (4 x U/I, 4 x TC/RTD), an ana- 
log output module with 4 channels (U/I), and an IO-Link master with 4 IO-Link sig- 
nals, 8 digital inputs, and 4 digital outputs. 


ET 200eco PN is equipped with a 2-port switch so that a linear topology can be set 
up without additional devices. The maximum data transfer rate on the PROFINET 
is 100 Mbiti/s. 


16.2.7 ET 200pro 


ET 200pro is a modular I/O system with 
degree of protection IP 65/67 for use 
without a control cabinet. It consists of 
a module support and connection mod- 
ules which accommodate the interface 
module for the bus connection and the 
electronic modules. Power modules for 
the load power supply combine the Fig. 16.6 ET 200pro with digital modules 
electronic modules into potential 

groups. 


The electronic modules are digital inputs/outputs and analog inputs/outputs. They 
can be replaced during ongoing operation. A frequency converter and motor 
starter (direct-on-line and reversing starter) as well as a pneumatic interface mod- 
ule with 16 outputs for the FESTO CPV 10 valve terminal are also available in this 
design. 


Interface modules are available for ET 200pro with a PROFIBUS DP interface (maxi- 
mum data transfer rate 12 Mbit/s) or a PROFINET IO interface (maximum data 
transfer rate 100 Mbit/s) with the facility for wireless connection to a PROFINET IO 
controller. The PROFINET interface module has a 2-port switch for easy configura- 
tion of a linear topology. 


Together with the IM 154-8 PN/DP CPU interface module, ET 200pro can be used as 
a mini PLC on site. Operation as a DP master or DP slave is possible on the PROFIBUS 
DP and as an IO controller on the PROFINET IO. The PLC functionality of the inter- 
face module corresponds to that of a CPU 315-2 PN/DP. 
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16.3 PROFINET IO 


16.3.1 PROFINET IO components 


PROFINET IO offers a standardized interface in accordance with IEC 61158 for in- 
dustrial automation over Industrial Ethernet. An IO controller in the central pro- 
grammable controller controls the data exchange with the distributed field devices 
which are referred to as IO devices (Fig. 16.7). 


Hardware components with PROFINET IO 


Transmission of process signals 


S7 station with 10-Controller, 
e.g. CPU 416-3 PN/DP 


S7 station as ET 200 station 
as intelligent IO device, as IO device, 
e.g. CPU 315-2 PN/DP e.g. ET 2008 


1 
Pie 


PROFINET IO 


PN/PN 

coupler 
PROFINET IO PROFIBUS DP A@ataentnee 
Connection between IO-subnets Connection to other subnets 


Fig. 16.7 Components of a PROFINET IO system 


Industrial Ethernet can be designed physically as an electrical, optical, or wireless 
network. FastConnect Twisted Pair (FC TP) cables with RJ45 connections or Indus- 
trial Twisted Pairs (ITP) cables with sub-D connections are available for implement- 
ing the electrical cabling. 


Fiber-optic (FO) cabling can consist of glass fiber, PCF, or POF. It offers galvanic iso- 
lation, is impervious to electromagnetic influences, and is suitable for long distanc- 
es. Wireless transmission uses the frequencies 2.4 GHz and 5 GHz with data trans- 
fer rates up to 54 Mbit/s (depending on the national approvals). 


IO controller 


The IO controller is the active participant on the PROFINET. It exchanges data cycli- 
cally with “its” IO devices. An IO controller can be: 
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> ACPU with integral PROFINET interface (with the letters “PN” in the short desig- 
nation, e.g. CPU 412-2 PN) or 


> Acommunication module in the PLC station (e.g. CP 443-1 Advanced). 


IO devices 


IO devices are the passive stations on the PROFINET IO. These can be stations with 
process inputs and outputs, routers, or link modules. Examples of IO devices from 
the ET 200 distributed I/O system are the ET 200eco, ET 200M, ET 2008S, and ET 
200pro. 


IO devices with user data are distinguished as follows: 


> Compact IO devices which are addressed like a single module 


> Modular IO devices which can contain several modules or submodules which are 
addressed individually 


> Intelligent IO devices with a configured transfer area as user data interface to the 
IO controller 


Intelligent IO devices contain a user program which controls the subordinate (own) 
modules. The user data interface to the IO controller is a transfer area which can be 
divided into different address areas. Examples of intelligent IO devices are S7 sta- 
tions with CPUs with integral IO device functionality, as well as the ET 2008S distrib- 
uted I/O station with the IM 151-8 PN/DP CPU interface and the ET 200pro distribut- 
ed I/O station with the IM 154-8 PN/DP CPU interface. 


An intelligent IO device can simultaneously be the IO controller for a subordinate 
PROFINET IO system. 


Coupling modules 


Bus couplers and link modules connect subnets and permit data exchange between 
stations connected on different subnets. The following are available for the 
Ethernet subnet: 


> PNI/PN coupler for connecting two Ethernet subnets 
> JE/PB Link PN IO for connecting an Ethernet subnet to a PROFIBUS subnet 
> JE/AS-i Link for connecting an Ethernet subnet to an AS-i subnet 


The coupling modules are described in more detail in Chapter 16.3.5 “Coupling 
modules for PROFINET IO” on page 646. 


PROFINET IO system 


The IO controller and all IO devices controlled by it constitute a PROFINET IO system 
(Fig. 16.8). An IO device is supplied with data by its IO controller within an update 
time which is calculated by STEP 7 in specific intervals and in turn sends its data to 
the IO controller. 


Several PROFINET IO systems can be operated in a PN/IE subnet. 
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10 controller 
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| an IO controller and one or more 
! 10 devices. All modules, whether 
; central or distributed, are in the 


| 
I 
I 
I 
! 
| same address area. 
I 
I 
I 
I 
I 
I 


User data interface PROFINET IO 
in the IO device 


Intelligent In the case of an intelligent IO device, which has its own modules 
IO device (arranged centrally from its own point of view), transfer areas 


form the user data interface to the PROFINET IO system. 
Ce The transfer areas are distributed modules for the IO controller, 
ca and central modules for the intelligent IO device. 


Fig. 16.8 Schematic representation of a PROFINET IO system 


16.3.2 Addresses with PROFINET IO 


Station addresses on the Ethernet subnet 


The stations on an Ethernet subnet which use the TCP/IP protocol are addressed via 
the IP address. This consists of four decimal numbers, each in the range from 0 to 
255, and is represented by four bytes separated by dots, for example 192.168.1.3. 
This address consists of the subnet number and the actual station address, which 
one can extract with the subnet mask from the IP address. Example: If the subnet 
mask has the value 255.255.255.0, the subnet number for the above-mentioned IP 
address is 192.168.1 and the station address 3. Each station on the PROFINET is ad- 
ditionally assigned a device name and device number. Further information on the 
station addresses in an Ethernet subnet can be found in Chapter 3.4.7 “Configuring 
a PROFINET subnet” on page 82. 


Geographic addresses with PROFINET IO 


The geographic address identifies the slot of a module. With an IO device, the geo- 
graphic address comprises the ID of the PROFINET IO system, the device number, 
the number of the slot, and possibly also a submodule number. 


The PROFINET IO system ID is assigned by STEP 7 and is in the range from 100 to 
115. Within the station, the “virtual” slot 0 (not physically present) represents the 
IO device. The modules with the user data are arranged in an IO device starting at 
slot 1 (Fig. 16.9). 
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Addresses in a PROFINET IO system 


10 controller (e.g. CPU 412-2 PN) 


The example shows an S7-400 
ae Module Addressiname station with an IO controller 
1 (Power supply PS) integrated in the CPU. The CPU is 
2 CPU module PLC_1 inserted into slot 2. 
2x1 MPIIDP interface 1 4095* ee 
2X5 PROFINET interface 1 Oe” The interface has two ports with the 
10 controller 4091* "slots" 2 X2 P1 und 2 X2 P2. 
IP addresse 192.168.0.7 
Device name plc_1 
Device number 0 
2X5 P1 Port_1 4093* 
2 X5 P2 Port_2 4092* 
3 1/0 interface module log. Address 
PROFINET IO system 
Subnet Industrial Ethernet 
Subnet name PN/IE_1 
Subnet mask 209,295,010 
S7 subnet ID lee eal 
10 system name PLC_1.PROFINET IlO-System 
10 system ID 100 
IO device (e.g. ET200M) 
With an IO device - an ET 200 station 
Slot Module Address/name in the example - the "virtual" slot 0 
0 Interface module IM 4090* represents the station. 
0x1 PROFINET interface 4089* The PROFINET interface is the only 
one, and therefore also the first 
IP address 192. 168:0.2 interface ("slot" 0X1). 
Device name io-device_1 The interface has two ports with the 
Device number 1 "slots" 0 X1 P1 and 0 X1 P2. 
0X1 P1 Port_1 4088* 
0X1 P2 Port_2 4087* 
il 10 module log. Adresse 


The geographic address of a module corresponds to the slot number supplemented by the device 
number of the IO device and by the PROFINET IO system ID. 


The logical addresses are used to address the user data of a module. These are input or output 
addresses depending on the transmission direction. The smallest logical address of a module is the 
module start address. The automatically assigned logical addresses can be changed. The module 
addresses must not overlap, they must be unambiguous. 


The diagnostics addresses are assigned an asterisk in the address overview. STEP 7 assigns the 
diagnostics addresses automatically during the configuration, starting with the highest input address 
available. The next lower addresses are then assigned in the sequence of the configuration. 

The diagnostics addresses can be changed. Just like the input addresses, they must be unambiguous 
and must not overlap with the other input addresses. 


Fig. 16.9 Addresses in a PROFINET IO system 
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Logical addresses with PROFINET IO 


The user data of the IO devices shares the range of logical addresses with the user 
data of the central modules in the S7 station with the IO controller. The logical ad- 
dresses of all modules are within the range of peripheral inputs or outputs. This 
means that the addresses of the central modules must not overlap with those of the 
IO devices. 


You use the logical address to address the user data, in other words the signal states 
of the digital input/output channels or the values at the analog input/output chan- 
nels. Each byte of user data is unequivocally defined by the logical address. The log- 
ical address corresponds to the absolute address. A symbol (name) can be assigned 
to it so that it is easier to read (symbolic addressing). Further details can be found 
in Chapter 4.2 “Addressing of operands and tags” on page 95. 


Consistent user data transfer to and from IO devices 


Data consistency means that a block of user data is handled together. With 
PROFINET IO, a block with up to 1024 bytes can be transferred consistently. 


A data block addressed in the process image, for example the user data area of a 
digital input module in the IO device, is transferred consistently during automatic 
updating of the process image. 


With direct access, for example when loading and transferring, you can consistently 
transfer an area of one byte, one word, or one doubleword. With a user data area of 
three bytes or more than four bytes, you use the system functions DPRD_DAT (read) 
and DPWR_DAT (write) for consistent data transfer. 


The handling of consistent user data areas in the user memory is described in 
Chapter 4.1.2 “Operand areas: inputs and outputs” in section “Consistent user data 
areas” on page 92. 


Diagnostic addresses with PROFINET IO 


Modules and stations with diagnostic data which do not have their own user data 
address are assigned a diagnostic address. A diagnostic address is within the area 
of logical input addresses. A diagnostic address can only be used to address diag- 
nostic data records. 


During configuration, STEP 7 assigns the diagnostic addresses downwards starting 
at the highest input address. You can change the diagnostic address. The address 
overview in the hardware configuration identifies a diagnostic address by means of 
an asterisk. 


Fig. 16.9 shows an example of the diagnostic addresses in an IO system. The PLC 
station with IO controller is a CPU 412-2 PN in this case with a maximum input ad- 
dress of 4095. This address is assigned to the first interface as the diagnostic ad- 
dress. The next smallest address is then the diagnostic address of the second 
(PROFINET) interface. Since the ports of the PROFINET interface and the IO control- 
ler can also supply diagnostic data, they are assigned the subsequently following 
diagnostic addresses. 
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The same principle is applied to an IO device. Slot 0, which presents the IO device, 
is assigned the diagnostic address which is the highest unused input address at the 
time of configuration (address 4090 in the example). The PROFINET interface and 
the ports are then assigned the following addresses. The automatic assignment of 
the diagnostic addresses is based on the configuration sequence. 


The diagnostic data is scanned in the user program by system blocks which use a 
user data address or diagnostic address for specification of the interrupt-triggering 
component. For a diagnostic interrupt, for example, the system block RALRM Read 
additional interrupt information can be used in the interrupt handler. You can use 
the system block RDREC Read data record to scan the diagnostic data record DS1, 
which contains the OB start information and additional component-specific diag- 
nostic data. 


User data interface with intelligent IO devices 


With the compact and modular IO devices, the addresses of the inputs and outputs 
are together with the addresses of the central modules in the address volume of the 
IO controller. With intelligent IO devices (abbreviated to: I-devices), the input/out- 
put modules of the IO device are assigned to the device CPU. Every intelligent IO 
device therefore has a user data interface as common memory area with the IO con- 
troller whose size depends on the device CPU used. 


The user data interface can be divided into several areas of different length. The in- 
dividual areas then respond like modules whose lowest address is the module start 
address. From the viewpoint of the IO controller, the intelligent IO device then ap- 
pears like a compact or modular IO device depending on the division. 


A transfer area which is represented as an input module from the viewpoint of the 
IO controller is an output module from the viewpoint of the IO device and vice ver- 
sa. The logical addresses on the controller side are in the address volume of the IO 
controller and the logical addresses on the device side in the address volume of the 
IO device. The addresses on the controller side can be different from those on the 
device side. 


You address a transfer area like a peripheral input (I:P) or peripheral output (Q:P). 
You can address transfer areas with addresses in the area of the process image like 
inputs (I) or outputs (Q). 


16.3.3 Special PROFINET configurations 


In the properties of the PROFINET interface, activate the PROFINET functions de- 
scribed below when configuring an IO controller or IO device (see next chapter). 


Media redundancy 


The media redundancy is used to increase the network availability by means of a 
special topology. The ends of a linear topology are connected into a ring topology 
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in a station at the two connections of the PN interface. This station is the redundan- 
cy manager and the connections are the ring ports. If a station in the ring network 
fails, an alternative communication path can be made available. 


Up to 50 devices can participate per ring by means of the Media Redundancy 
Protocol (MRP) used with SIMATIC S7. The media redundancy must be configured 
in the interface properties of all participating stations under Advanced options > 
Media redundancy. IRT communication cannot be used if media redundancy is con- 
figured. 


Changing IO devices during operation 


When replacing an IO device, a device name must be assigned to the new IO device 
in order to make it known (again) to the IO controller. This can be carried out - 
depending on the IO device - using a memory card or the programming device. 


Under certain conditions, the new IO device can be identified by means of neighbor 
relationships between the other IO devices and the IO controller and assigned a 
new device name by the IO controller. One of the requirements is that a port con- 
nection is configured and the Support device replacement without exchangeable 
medium checkbox is activated when configuring the interface properties under 
Advanced options > Interface options. Only new IO devices or IO devices which have 
been reset to the factory settings should be used as replacement devices. 


Prioritized startup 


With a prioritized startup, the startup of IO devices in a PROFINET IO system with 
RT and IRT communication is carried out faster. Special cabling conditions must be 
observed. The maximum possible number of IO devices controlled with prioritized 
startup depends on the IO controller used. 


You configure the prioritized startup in the properties of the PROFINET interface of 
an IO device using the Prioritized startup checkbox. You can find the checkbox under 
Advanced options > Interface options or - with an intelligent IO device - under 
Operating mode (with IO device mode switched on and assigned IO controller). 


16.3.4 Configuring PROFINET IO 


General procedure 


A prerequisite for configuration of the distributed I/O with PROFINET IO is a created 
project with a PLC station. To select the stations involved, start the hardware con- 
figuration in the Network view. 


> The starting point for the configuration is the IO controller - either integrated in 
a CPU 400 with PN interface or in the CP 443-1 Advanced communication mod- 
ule. The JO controller mode is preset. 


> Assign a PROFINET IO system to the PN interface of the IO controller. 
The Ethernet subnet required is created automatically in the process. 
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Select an IO device from the hardware catalog and drag it with the mouse into 
the working window. 


Link the IO device to the PROFINET IO system by dragging the PN interface of the 
IO device with the mouse to the PN interface of the IO controller. 


Repeat the last two steps for every further IO device. 


To parameterize a PN interface, select it in the working window and set the 
desired properties in the inspector window. 


To configure an intelligent IO device, drag it as a PLC station into the working 
window, set JO device mode in the properties of the PN interface, assign the 
IO controller, and configure the transfer areas of the user data interface. 


The result is networking of the IO controller with the assigned IO devices to a 
PROFINET IO system (Fig. 16.10). 


PLC_1 
CPU 416-3 PNIDP, 


Highlight lO system: 


Ml PLC_1.PROFINET 10-System (100) 


10 device_1 = 10 device_2 PLC_3 
IM154-4PNHF _ll IM 153-4PN CPU 319-3 PNIDP 
PLC_1 PLC_1 PLC_1 


Fig. 16.10 Example of representation of a PROFINET IO system 


You then make the parameter settings for the stations and the fitting with in- 
put/output modules in the Device view. 


Configuring the IO controller in the Network view 


Prerequisite: You have created a project and a PLC station, for example a CPU 400 
with PN interface. Start the device configuration and select the Network view tab in 
the working window. 


Select the PN interface shown in green in the graphic of the CPU and then the Ethernet 
addresses group in the Properties tab in the inspector window. Activate the Set 
IP address in the project option and change the preset IP address and subnet mask if 
necessary. Information on the IP address can be found in Chapter 3.4.7 “Configuring 
a PROFINET subnet” on page 82. Activate the Set IP address using a different method 
option if you wish, for example, to set the IP address per user program. 
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Set the mode: Select the Operating mode group in the interface properties and acti- 
vate the IO controller checkbox if this is not already preset. 


Connect the PN interface to a PROFINET subnet. You can do this in the properties of 
the PN interface: Select an existing subnet under Ethernet address in the Subnet 
drop-down list or create a new subnet using the Add new subnet button. You can al- 
so click on the PN interface with the right mouse button and select the Add subnet 
command from the shortcut menu. A green subnet is shown with the name PN/IE_x. 
You can change the name in the subnet properties. 


Configure a PROFINET IO system. To do this, click with the right mouse button on 
the PN interface and select the Assign IO system command from the shortcut menu. 
A green/white marking is shown with the name <Station name>.PROFINET IO system 
(xxx). xxx is the number of the IO system. You can change the name and number in 
the properties of the PROFINET IO system. 


Adding an IO device to the IO system 


With the left mouse button pressed, drag the desired IO device from the hardware 
catalog to the IO system on the working area. Fig. 16.10 shows two stations of the 
distributed I/O: An ET200pro station from the object tree Distributed I/O > ET 200pro 
> Interface modules > PROFINET > IM 154-4 Cu >... and an ET 200M station from the 
object tree Distributed I/O > ET 200M > Interface modules > PROFINET > IM 153-4 PN 
Siey 


The interfaces of the IO devices are connected in the graphic with the green/white 
marking and are thus part of the PROFINET IO system. 


The automatically assigned station name is applied as the PROFINET device name. 
You can change the name in the station properties and also the device number and 
IP address. 


Configuring an IO device 


With the IO device selected, you can set its properties in the inspector window in the 
Device view. You fit a modular IO device with the desired modules or submodules 
from the hardware catalog and then set their parameters. 


You set the Ethernet addresses in the properties of the PROFINET interface. In the 
Advanced options group you can additionally set - depending on the application - 
for example the prioritized startup, the device replacement without removable 
medium, or participation in media redundancy. 


Coupling an intelligent IO device to the PROFINET IO system 


You initially create an intelligent IO device (“I-device”) as a stand-alone PLC station 
and then connect the PN interface of the I-device to the PROFINET IO system. You 
can find the I-devices in the hardware catalog in the PLC folder. 
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For example, if you wish to create an ET2008S station as an I-device, drag the inter- 
face module with the left mouse button pressed from the object tree PLC > 
SIMATIC ET 200 CPU > IM 151-8 PN/DP CPU >... to the working area. 


You establish a connection to the existing subnet if you drag the PN interface of the 
I-device to a PN interface of another device on the subnet with the left mouse button 
pressed, for example to the PN interface of the IO controller. 


In the properties of the PN interface of the I-device, activate the IO device checkbox 
under the Operating mode entry and select the assigned IO controller from the 
drop-down list. The station is then added as an IO device to the PROFINET IO 
system. 


Configuring the user data interface 


You configure the user data interface to the IO controller in the module properties 
of the I-device. Select the CPU or ET station in the working window and then the Op- 
erating mode > I-device communication group in the inspector window in the Prop- 
erties tab under the PROFINET interface group. 


Double-click on <Add new> in the Transfer areas table. A new transfer area is creat- 
ed. You can change the name in the Transfer area column. Select the type (CD) from 
the drop-down list in the Type column and click in the Data direction (<>) column on 
the arrow in order to set the type of transfer area (arrow to right > means input ar- 
ea, arrow to left < means output area from the viewpoint of the I-device). 


General 


~ General 
2 : > Transfer area_O 
Catalog information 
Ethernet addresses 
Time-of-day synchronization Datalle orthatrarcteraras 
Operating mode 
 Hdevice communication Transferarea Transfer area_O } 
Mransfer area_0} area_O f fa —— 7 = 
> Real time settings UpHC ANSE (Kee | | 
> Advanced options Partner Local 
Diagnostics addresses 7 lat 
i Date exchange between — PLC_1 and [PLC_2 
[ Slot / subslot [ i [ 0 } 
id Address type Q iba) [ I |y) 
Startaddress | 16 [=] [12 $ 
Process image | OB1-Fl |! | OB1+I ly) 
Length [bytes] [4 > 
Comment 


Fig. 16.11 Example of configuration of a transfer area 
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Now set the start address in the Address in I-device column and the length of the 
transfer area in the Length column. In the Address in IO controller column, set the 
start address which the transfer area has from the viewpoint of the IO controller. 


In this manner you can configure further transfer areas. The configured transfer ar- 
eas are displayed in the I-Device communication properties group. If you click a 
transfer area here, you obtain its details (Fig. 16.11). If the set address is in the pro- 
cess image, you can select in this display whether the updating is to be carried out 
in the OB1 process image (OB1-PA) or in a process image partition (TPAx). 


16.3.5 Coupling modules for PROFINET IO 


PNIPN coupler: connection of two Ethernet subnets 


A PNIPN coupler connects two Ethernet subnets in order to exchange data between 
the IO controllers of the two subnets. There is galvanic isolation between the sub- 
nets. 


The two sides of the PN/PN coupler each represent an IO device when configuring. 
One side (one IO device) is coupled to one of the PROFINET IO systems, the other 
side to the other system. 


You can find the PN/PN coupler in the hardware catalog under Other field devices > 
PROFINET IO > Gateway > Siemens AG > PN/PN couplers > PN/PN coupler Vx.0 >.... The 
modules underneath this represent the two sides of the PN/PN coupler (X1 for the 
left side and X2 for the right side of the module). 


In order to connect the PN/PN coupler, drag the symbol for one side of the PN/PN 
coupler with the left mouse button pressed to the PROFINET IO system. You can set 
the properties of the PN/PN coupler, for example IP address, device name and device 
number, in the inspector window with the module selected. You configure the sec- 
ond side (X2) of the PN/PN coupler on the other PROFINET IO system in the same 
manner. 


TE/PB Link PN IO: connection of PROFINET IO to PROFIBUS DP 


An IE/PB Link PN IO connects the Industrial Ethernet and PROFIBUS subnets. In 
standard mode, the link permits cross-subnet PG/OP communication and commu- 
nication via S7 connections, parameterization of field devices via data record rout- 
ing, and the network transition to a DP master system with constant bus cycle time. 


When operating as PROFINET IO proxy, the IE/PB Link PN IO takes over the role of a 
proxy for the DP slaves on the PROFIBUS. The IO controller on the PROFINET can 
then address the DP slaves on the PROFIBUS like IO devices in its PROFINET IO 
system. 


The IE/PB Link PN IO is a double-width module of S7-300 design. You connect the 
IE/PB Link to Industrial Ethernet using an 8-pole RJ45 socket and to PROFIBUS using 
a 9-pole SUB-D socket. 
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The IE/PB Link PN IO is configured as an IO device to which a DP master system is 
connected. You can find the link in the hardware catalog under Network compo- 
nents > Gateways > IE/PB Link PN IO > .... In order to add it to the PROFINET IO sys- 
tem, drag it with the left mouse button pressed to the PROFINET IO system in the 
working window. 


You set the operating mode - standard mode or PROFINET IO proxy - in the link 
properties under Network gateway. You configure the Ethernet addresses and the 
real-time settings in the PROFINET interface group. 


You configure the setting of the PROFINET device number and the assignment to 
the PROFIBUS station number in the properties of the IE/PB Link. The table shown 
in the PROFINET device number group contains the PROFIBUS station number in the 
PB address column and the device number assigned by STEP 7 in the PROFINET 
device number column. To change the device number, click in the cell with the de- 
vice number and select an unused device number from the drop-down list. If you 
activate the checkbox in the Device number = PB address column, the PB address and 
the device number are set the same. 


The IE/PB Link PN IO is the DP master of the subordinate PROFIBUS DP master sys- 
tem. How to configure a DP master system with the assigned DP slaves is described 
in Chapter 16.4.3 “Configuring PROFIBUS DP” on page 656. 


IE/AS-i Link PN IO: Connecting PROFINET IO to the AS-Interface 


An IE/AS-i Link PN IO connects PROFINET IO with AS-Interface. On PROFINET IO, the 
link is an IO device. On the AS-Interface, it is an AS-i single or double master in ac- 
cordance with the AS-i specification V3.0. 


Connection to the IO controller is via a user data interface with 62 bytes digital in- 
puts and 62 bytes digital outputs. A programming device can be connected via the 
integral Ethernet port for commissioning, testing, and diagnostics via a web inter- 
face with a standard browser. The link allows uploading of the AS-i configuration to 
the programming device. 


16.3.6 Real-time communication with PROFINET IO 
PROFINET IO offers several types of data transfer: 


> Non-time-critical data such as configuration and diagnostic information is 
transferred acyclically with the TCP/IP communication standard. 


> User data (input/output information) is exchanged cyclically between the IO con- 
troller and the IO device (real-time RT) within a defined time period - the update 
time. 


> Time-critical user data, e.g. for motion control applications, is transferred iso- 
chronously with hardware support (isochronous real-time IRT). 


A permanent communication channel is reserved on the Ethernet subnet for IRT 
communication. RT communication - cyclic data exchange between the IO control- 
ler and IO devices - and non-real-time TCP/IP communication take place parallel to 
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the update time. In this way, all three communication types can exist in parallel on 
the same subnet. 


Configuration of IRT communication is not possible with STEP 7 V11 Professional. 


Send frequency in the PROFINET IO system 


Cyclic data exchange is handled within a specific time frame, the send frequency. 
STEP 7 calculates the send frequency from the configuration information on the 
PROFINET IO system. The send frequency is the shortest possible update time. 


You configure the send frequency in the interface properties of the IO controller. 
With the PN interface selected, select a value in the properties tab under Advanced 
options > Real-time settings > IO communication from the drop-down list Shortest 
possible update interval. 


Update time and watchdog timer for IO devices 


The update time is the period within which each IO device in the IO system has ex- 
changed its user data with the IO controller. The update time corresponds to the 
send clock or a multiple thereof. You can increase the update time manually, for ex- 
ample to reduce the bus load. Under certain circumstances, you can reduce the up- 
date time for individual IO devices if you in return increase the update time for oth- 
er devices whose user data can be exchanged non-time-critically. 


If the IO device is not supplied by the IO controller with input or output data within 
the watchdog timer, it switches to a safe state. The watchdog timer is calculated as 
the product of update time and “Accepted updating cycles without IO data”. 


You configure the times in the interface properties of the IO device. To do this, 
select the IO device and then the PROFINET interface > Advanced options > Real-time 
settings > IO cycle group in the properties tab. Under Update time, select the 
Can be set option and then the update time from the drop-down list. To achieve 
automatic adaptation to the send frequency, activate the Adapt update time when 
send clock changes checkbox. You select the watchdog timer in the Accepted update 
cycles without IO data drop-down list. 


Real-time 


Real-time (RT) means that a system processes external events within a defined time. 
If it responds predictably, it is called deterministic. In RT communication, transfer 
takes place at a specific point in time (send clock) within a defined interval (update 
time). PROFINET IO allows the use of standard network components for RT commu- 
nication. 


If not all data to be exchanged is transferred within the planned time frame, for ex- 
ample due to the addition of new network components, some data is distributed to 
other send frequencies. This can result in an increase in the update time for indi- 
vidual IO devices. 
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16.4 PROFIBUS DP 


16.4.1 PROFIBUS DP components 


PROFIBUS DP offers an interface in accordance with the international standard IEC 
61158/61784 for transmission of process data between an “interface module” in the 
central programmable controller and the field devices. This “interface module” is 
referred to as DP master and the field devices as DP slaves (Fig. 16.12). 


The PROFIBUS network can be designed physically as an electrical network, optical 
network, or wireless coupling with different data transfer rates. The length of a seg- 
ment depends on the transfer rate and is adjustable in steps for an electrical or optical 
network from 9.6 Kbit/s to 12 Mbit/s. The electrical network can be configured as a bus 
or tree structure. It uses a shielded, twisted two-wire cable (RS485 interface). 


The optical network uses either plastic, PCF or glass fiber-optic cables. It is suitable 
for long distances, offers galvanic isolation, and is impervious to electromagnetic 


Hardware components with PROFIBUS DP 
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Fig. 16.12 Hardware components with PROFIBUS DP 
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influences. Using optical link modules (OLMs) it is possible to construct a linear, 
ring, or star topology. An OLM also provides the connection between electrical and 
optical networks with a mixed design. A cost-optimized version is the design as a 
linear topology with integral interface and optical bus terminal (OBT). 


Using the PROFIBUS Infrared Link Module (ILM), a wireless connection can be pro- 
vided for one or more PROFIBUS slaves or segments with PROFIBUS slaves. The 
maximum data transfer rate of 1.5 Mbit/s and the maximum range of 15 m mean 
that communication is possible with moving system components. 


DP master 


The DP master is the active station on the PROFIBUS. It exchanges data cyclically 
with “its” DP slaves. A DP master can be: 


> A CPU with integral PROFIBUS interface (with the letters “DP” in the short 
designation, e.g. CPU 412-2 DP) 


> Acommunication module in the PLC station (e.g. CP 443-5 Extended) 


> The IE/PB Link PN IO 


DP slaves 


The DP slaves are the passive stations on the PROFIBUS DP. These can be stations 
with process inputs and outputs, repeaters, couplers, or link modules. Examples of 
DP slaves from the ET200 distributed I/O system are the ET 200eco, ET 200M, ET 
2008S, and ET 200pro. 


DP slaves with user data are distinguished as follows: 


> Compact DP slaves which are addressed like a single module 


> Modular DP slaves which can contain several modules or submodules 
which are addressed individually 


> Intelligent DP slaves with a configured transfer area as user data interface 
to the DP master 


Intelligent DP slaves contain a user program which controls the subordinate (own) 
modules. The user data interface to the DP master is a transfer area which can be 
divided into different address areas. Examples of intelligent DP slaves are 
S7 stations with CPUs having an integral DP slave functionality, as well as the 
ET 200S distributed I/O station with the IM 151-7 CPU interface and the ET 200pro 
distributed I/O station with the IM 154-8 PN/DP CPU interface. 


A CPU which is configured as an intelligent DP slave cannot be a DP master at the 


same time. However, a CP 443-5 communication module can be operated as DP 
master in the station with an intelligent DP slave. 


650 


16.4 PROFIBUS DP 


Coupling modules 


Bus couplers and link modules connect subnets and permit data exchange between 
stations connected on different subnets. The following are available for the 
PROFIBUS subnet: 


RS 232 repeater for regeneration of the bus signals 

Diagnostics repeater for diagnostics of bus faults 

DP/DP coupler for connecting two PROFIBUS subnets 

DP/AS-i link for connecting a PROFIBUS subnet to an AS-i subnet 


IE/PB Link PN IO for connecting an Ethernet subnet to a PROFIBUS subnet 


The repeater modules, the DP/DP coupler, and the DP/AS-i link are described in 
more detail in Chapter 16.4.4 “Coupling modules for PROFIBUS DP” on page 659 , 
the IE/PB Link PN IO in Chapter 16.3.5 “Coupling modules for PROFINET IO” on page 
646. 


PROFIBUS DP master system 


The DP master and all DP slaves controlled by it form a PROFIBUS DP master system 
(Fig. 16.13). The update time within which a DP slave receives data from its DP mas- 
ter and in turn sends data to the DP master depends on the number of DP slaves in 
the master system. 
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ee aa ae IRs areca mee Uae cates NO oc estos § (ADP inaster systenvconsisis of a 
DP master and one or more DP slaves. 
All modules, whether central or 
distributed, are in the same address 
area. 


User data interface PROFIBUS DP 


! 
! 
! 
! 
! 
! 
! 
! 
! 
! 
in the DP slave H 


Intelligent In the case of an intelligent DP slave, which has its own modules 
ne. 1 a (arranged centrally from its own point of view), transfer areas 
Seave form the user data interface to the DP master system. The transfer 


Ee areas are distributed modules for the DP master, and central 
aa modules for the intelligent DP slave. 


Fig. 16.13 Schematic representation of a PROFIBUS DP master system 
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PROFIBUS DP is usually operated as a “mono-master system”, i.e. a single DP master 
in a bus segment controls several DP slaves. Except for a temporary programming 
device for diagnostics and servicing, the DP master is the only master on the bus. 


You can also install several DP master systems in a PROFIBUS subnet (“multi-master 
system”). However, this increases the response time in individual cases since, once 
a DP master has supplied “its” DP slaves, the access privileges are assigned to the 
next DP master which in turn supplies “its” DP slaves, etc. 


DPV0, DPV1, and S7-compatible operating modes 


DP slaves and DP masters are available with different scopes of PROFIBUS functions. 


DP slaves with a range of functions in accordance with EN 50170 (abbreviated to: 
“DPVO slaves”) can handle the cyclic exchange of process data. DP slaves with a 
range of functions in accordance with IEC 61158/EN 50170 Volume 2 (abbreviated 
to: “DPV1 slaves”) have an extended functionality in addition to the cyclic data ex- 
change, e.g. an increased diagnostics and parameterization capability through the 
use of data records transferred acyclically or the use of new types of interrupt. 
PROFIBUS devices from Siemens (“DP S7 slaves”), which can handle further func- 
tions in addition to the cyclic data exchange, e.g. diagnostic interrupts, have the 
operating mode “S7-compatible”. 


The operating modes of DP master and DP slaves must be matched to each other. 
DP masters in operating mode “DPVO” control DPVO slaves, those in operating 
mode “S7-compatible” control DPVO and DP S7 slaves. DPV1 masters from Siemens 
can control DP slaves with all operating modes. 


16.4.2. Addresses with PROFIBUS DP 


Station addresses on PROFIBUS DP 


Each station on the PROFIBUS subnet has a unique address within the subnet - the 
station address (station number) - which distinguishes it from all other stations on 
the subnet. The station (the DP master or a DP slave) is addressed on the PROFIBUS 
by means of this station address. 


STEP 7 assigns the station addresses automatically and you can change the address- 
es within the specified range. You set the highest station address in the properties 
of the subnet or DP master system under Network settings. 


Geographic address with PROFIBUS DP 


The geographic address identifies the slot of a module. With a DP slave, the geo- 
graphic address comprises the ID of the DP master system, the station number, and 
the slot number. 


The DP master system ID is assigned by STEP 7 and is in the range from 1 to 32. The 
name and ID can be changed in the properties of the DP master system under Gen- 
eral. 
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Slot numbering of a DP slave depends on its type. If it is integrated using a GSD file, 
the entries in the GSD file determine the slot at which the I/O modules start. With 
DP standard slaves, the slots for I/O modules start at 1. The slot numbering of a DP 
S7 slave depends on the slots of an S7-300 station. Slots 1 (power supply) and 3 
(expansion unit interface module) remain vacant. Slot 2 (CPU) corresponds to the 
interface module (header module) of the modular DP slave. The signal modules 
(SM) are positioned starting at slot 4. There is also the “virtual” slot 0 (not physically 
present); this represents the complete station. 


Logical addresses with PROFIBUS DP 


The user data of the DP slaves share the range of logical addresses with the user da- 
ta of the central modules in the DP master station. The logical addresses of all mod- 
ules are within the range of peripheral inputs or outputs. This means that the 
addresses of the central modules must not overlap with those of the DP slaves. 


You use the logical address to address the user data, in other words the signal states 
of the digital input/output channels or the values at the analog input/output chan- 
nels. Each byte of user data is unequivocally defined by the logical address. The log- 
ical address corresponds to the absolute address; a symbol (name) can be assigned 
to it so that it is easier to read (symbolic addressing). Further details can be found 
in Chapter 4.2 “Addressing of operands and tags” on page 95. 


Consistent user data transfer to and from DP slaves 


Data consistency means that a block of user data is handled together without inter- 
ruption. With PROFIBUS DP and a CPU 400, a block with a maximum of 32 bytes can 
be transferred consistently. 


A data block addressed in the process image, for example the user data area of a 
digital output module in the DP slave, is transferred consistently during automatic 
updating of the process image. 


With direct access, for example when loading and transferring, you can consistently 
transfer an area of one byte, one word, or one doubleword. With a user data area of 
three bytes or more than four bytes, you use the system functions DPRD_DAT (read) 
and DPWR_DAT (write) for consistent data transfer. 


The handling of consistent user data areas in the user memory is described in 
Chapter 4.1.2 “Operand areas: inputs and outputs” in section “Consistent user data 
areas” on page 92. 


Diagnostic addresses with PROFIBUS DP 


Modules and stations with diagnostic data which do not have their own user data 
address are assigned a diagnostic address. A diagnostic address is within the area 
of logical input addresses. A diagnostic address can only be used to address diag- 
nostic data records. 


During configuration, STEP 7 assigns the diagnostic addresses downwards starting 
at the highest input address. You can change the diagnostic address. The address 
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overview in the hardware configuration identifies a diagnostic address by means of 
an asterisk. 


Fig. 16.14 shows an example of the diagnostic addresses in an DP master system. 
The PLC station with integrated DP master is a CPU 414-3 PN/DP in this case with a 
maximum input address of 8191. This address is assigned to the first interface as 
the diagnostic address. The next smallest address is then the diagnostic address of 
the second interface. Since the ports of this second interface can also deliver diag- 
nostic data, they are assigned the subsequently following diagnostic addresses. 


A compact DP slave has one diagnostic address for the complete station, as with a 
modular DPV1 slave. A DP S7 slave with the S7-300 slot model has one diagnostic 
address for the station and one for the interface module. 


The diagnostic data is scanned in the user program by system blocks which use a 
user data address or diagnostic address for specification of the interrupt-triggering 
component. For a diagnostic interrupt, for example, the system block RALRM Read 
additional interrupt information can be used in the interrupt handler. You can use 
the system block RDREC Read data record to scan the diagnostic data record DS1, 
which contains the OB start information and additional component-specific diag- 
nostic data. 


Diagnostic addresses with intelligent DP slaves 


In addition to the logical addresses of the transfer areas, the user data interface 
has one diagnostic address for device diagnostics and one for signaling mode 
transitions. You can find these diagnostic addresses in the properties of the DP 
interface under Operating mode > I-slave communication in the area Diagnostics 
address of communication. The DP master obtains information about the status of 
the DP slaves via the master address. The DP slave obtains information about the 
status of the DP master via the slave address. 


User data interface with intelligent DP slaves 


With the compact and modular DP slaves, the addresses of the inputs and outputs 
are together with the addresses of the central modules in the address volume of the 
DP master. With intelligent DP slaves (abbreviated to: I slaves), the input/output 
modules of the DP slaves are assigned to the slave CPU. Every intelligent DP slave 
therefore has a user data interface as common memory area with the DP master 
whose size depends on the slave CPU used. 


The user data interface can be divided into several areas of different length and data 
consistency. The individual areas then respond like modules whose lowest address 
is the module start address. From the viewpoint of the DP master, the I-slave then 
appears like a compact or modular DP slave depending on the division. 


A transfer area which represents an input module from the viewpoint of the DP 
master is an output module from the viewpoint of the DP slave and vice versa. The 
logical addresses on the master side are in the address volume of the DP master and 
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Addresses in a PROFIBUS DP master system 


DP master (e.g. CPU 414-3 PN/DP) 


In an S7-300 station, the DP master 


Slot Module Addressmame is integrated in the CPU module. 
1 (Power supply PS) This is inserted in slot 2. 
2 CPU module PLC il In the example, the combined 

5 z MPI/PROFIBUS interface is the 
as iO US eS Big first interface of the CPU module 
2X5 PROFINET interface 1 8190* ("slot" 2 X1). Itis assigned the 
2X5 PI Port 1 3189* highest input address as the 

= diagnostics address. 

2X5P2—Port_2 8188 The next diagnostic addresses are 
4 1/0 module log. Address occupied by the PN interface. 
5 10 module log. Address The logical addresses for the signal 


modules commence with slot 4. 


PROFIBUS DP master system 


Subnet PROFIBUS 
Subnet name PROFIBUS_1 
S7 subnet ID 53911 


DP master system name PLC_1.DP-Mastersystem 
DP master system ID 1 


DP slave_1 (e.g. ET200 eco) 


Slot Module Address With a compact DP slave an 

ET 200eco station in the example 
0 Interface module IM 8187* the "virtual" slot 0 represents the 
il 1/0 module log. Address station. 


DP slave_2 (e.g. ET200M) 


With a modular DP slave an 

Slot Module Address ET 200M station with the $7-300 slot 
0 ET 200M station 8185* model in the example the "virtual" 
slot 0 represents the station. 

The interface module is present in 
Interface module IM 8186* slot 2. 

a The logical addresses for the signal 
modules commence with slot 4. 


BWN = 


10 module log. Address 


The geographic address of a module corresponds to the slot number supplemented by the station 
number of the DP slave and by the DP master system ID. In the (modular) $7-300 slot model, 
the I/O modules are addressed commencing with slot 4, otherwise commencing with slot 1. 


The logical addresses are used to address the user data of a module. These are input or output 
addresses depending on the transmission direction. The smallest logical address of a module is the 
module start address. The automatically assigned logical addresses can be changed. The module 
addresses must not overlap, they must be unambiguous. 


The diagnostics addresses are assigned an asterisk in the address overview. STEP 7 assigns the 
diagnostics addresses automatically during the configuration, starting with the highest input address 
available. The next lower addresses are then assigned in the sequence of the configuration. 

The diagnostics addresses can be changed. Just like the input addresses, they must be unambiguous 
and must not overlap with the other input addresses. 


Fig. 16.14 Addresses in a DP master system 
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the logical addresses on the slave side in the address volume of the DP slave. The 
addresses on the master side can be different from those on the slave side. 


You address a transfer area like a peripheral input (I:P) or peripheral output (Q:P). 
You can address transfer areas with addresses in the area of the process image like 
inputs (I) or outputs (Q). 


16.4.3 Configuring PROFIBUS DP 


General procedure 


A prerequisite for configuration of the distributed I/O with PROFIBUS DP is a created 
project with a PLC station. To select the stations involved, start the hardware con- 
figuration in the Network view. 


> The starting point for the configuration is the DP master - either integrated in a 
CPU 400 with DP interface or in the form of the CP 443-5 Extended communica- 
tion module. 


If the interface is acombined MPI/DP interface, set the interface type to PROFIBUS 
in the interface properties. 
Activate the DP master mode of the DP interface. 


Assign a PROFIBUS DP master system to the DP interface of the DP master. 
The PROFIBUS subnet required is created automatically in the process. 


Set the bus parameters if necessary (highest PROFIBUS address, data transfer 
rate, profile). 


Select a DP slave from the hardware catalog and drag with the mouse into the 
working window. 


Link the DP slave to the DP master system by dragging the DP interface of the 
DP slave with the mouse to the DP interface of the DP master. 


Repeat the last two steps for every further DP slave. 


To parameterize the DP interface, select it in the working window and set the de- 
sired properties in the inspector window. 


You drag an intelligent DP slave as a stand-alone PLC station into the working 
window, set the interface type to PROFIBUS (with a combined MPI/DP interface), 
set the DP slave mode in the properties of the DP interface, assign the DP master, 
and configure the transfer areas of the user data interface. 


The result is networking of the DP master with the assigned DP slaves to a PROFIBUS 
DP master system (Fig. 16.15). 


You then make the parameter settings for the stations and the fitting with in- 
put/output modules in the Device view. 


Configuring the DP master in the Network view 


Prerequisite: You have created a project and a PLC station, for example a CPU 400 
with DP interface. Start the device configuration and select the Network view tab in 
the working window. 
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PLC_2 
CPU 414-3 PNIDP 


Highlight master system: 
ff PLC_2.DP-Mastersystem (1) 


ps ot ee eet ee et et tet tan ne it PLC_2.DP-Mastersystem (1) 


Slave_1 Slave_2 PLC_3 
ET 200eco 8DI/8... IM 153-2 CPU 319-3 PNIDP 
PLC_2 i_| PLC_2 


Fig. 16.15 Example of representation of a PROFIBUS DP master system 


If the CPU has acombined MPI/DP interface, you must first change over the interface 
since this combined interface is set as standard to MPI mode. Select PROFIBUS as the 
interface type in the interface properties under MPI address in the Parameters box. 


In order to assign a DP master system to the interface, click with the right mouse 
button on the DP interface in the working window and select the Assign master sys- 
tem command from the shortcut menu. A PROFIBUS subnet and a magenta-white 
DP master system is created with the name <Station name>.DP master system (<Mas- 
ter system ID>). You can change the master system ID in the properties of the DP 
master system under General. 


You can change the highest PROFIBUS address, the data transfer rate, and the bus 
profile in the properties of the DP master system or in the properties of the 
PROFIBUS subnet under Network settings. 


Adding a DP slave to the DP master system 


With the left mouse button kept pressed, drag the desired DP slave from the hard- 
ware catalog to the DP master system in the working window. Fig. 16.15 shows 
two stations of the distributed I/O: An ET 200eco station from the object tree 
Distributed I/O > ET 200eco > Compact modules PROFIBUS > DI/DO > 8DI/8DO > ... and 
an ET 200M station from the object tree Distributed I/O > ET 200M > Interface 
modules > PROFIBUS > IM 153-2 >.... 


The interfaces of the DP slaves are connected in the graphic with the magenta-white 
marking and are thus part of the PROFIBUS DP master system. 


Configuring a DP slave 


With the DP slave selected, you can set its properties in the Device view. You fit a 
modular DP slave with the desired modules or submodules from the hardware 
catalog and then set their parameters. 
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You set the PROFIBUS address in the properties of the PROFIBUS interface. Further- 
more, it is possible in the Module parameters group and depending on the DP slave 
and application to set, for example, the startup property Startup if preset configura- 
tion does not match actual configuration, the DP interrupt mode, or the handling of 
options. 


Coupling an intelligent DP slave to the PROFIBUS DP master system 


You initially create an intelligent DP slave (“I-slave”) as a stand-alone PLC station 
and then connect the DP interface of the I-slave to the DP master system. You can 
find the I-slaves in the hardware catalog in the PLC folder. 


For example, if you wish to create an ET200S station as an I-slave, drag the interface 
module with the left mouse button pressed from the object tree PLC > 
SIMATIC ET 200 CPU > IM 151-8 PN/DP CPU >... to the working window. 


You establish a connection to the existing subnet if you drag the DP interface of the 
DP slave to the DP interface of another device on the subnet with the left mouse but- 
ton pressed, for example to the DP interface of the DP master. With an S7-400 sta- 
tion with combined MPI/DP interface as I-slave, you must first set PROFIBUS as the 
interface type in the interface properties. 


In the properties of the DP interface of the I-slave, activate the DP slave option under 
the Operating mode entry and select the assigned DP master from the drop-down 
list. The station is then added as DP slave to the PROFIBUS DP master system. 


Configuring the user data interface 


You configure the user data interface to the DP master in the module properties of 
the I-slave. Select the CPU or the ET station in the working window and then the 
Operating mode > I-slave communication entry in the inspector window in the 
Properties tab in the DP interface group. 


Click on <Add new> in the Transfer areas table. A new transfer area is created. You 
can change the name in the Transfer area column. Select the type (MS) from the 
drop-down list in the Type column and click in the Data direction (<>) column on the 
arrow in order to set the type of transfer area (arrow to right > means input area, 
arrow to left < means output area from the viewpoint of the I-slaves). 


Now set the start address in the Slave address column and the length of the transfer 
area in the Length column. The transfer area has a maximum length of 32 bytes. In 
the Master address column, set the start address which the transfer area has from 
the viewpoint of the DP master. In the Consistency column you can select between 
Unit and Total length (Fig. 16.16). 


In this manner you can configure further transfer areas. The configured transfer ar- 
eas are displayed in the I-slave communication properties group. If you click a trans- 
fer area here, you obtain its details. If the set address is in the process image, you 
can select in this display whether the updating is to be carried out in the OB1 pro- 
cess image (OB1-PA) or in a process image partition (TPA). 
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General 


bslave communication 


Transfer areas 


Tremafer ares Type Mavier addrect = €¢ Saveaddren: Length Comuttency 
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Diagnostics address of communication 


Matter address Mave address 
Devke Gegnosocs 2039 2066 


Operating mode changes: = 2038 2065 


Fig. 16.16 Example of configuration of the transfer areas of an I-slave 


16.4.4 Coupling modules for PROFIBUS DP 


RS485 repeater for PROFIBUS DP 


The RS485 repeater connects two bus segments together in a PROFIBUS subnet. The 
number of stations and the size of the subnet can then be increased. The repeater 
provides signal regeneration and galvanic isolation. It can be used at data transfer 
rates up to 12 Mbit/s - including 45.45 Kbit/s for PROFIBUS PA. 


It is not necessary to configure the RS 485 repeater; it need only be considered when 
calculating the bus parameters. 


Diagnostics repeater for PROFIBUS DP 


The diagnostics repeater can determine the topology in a PROFIBUS segment 
(RS485 copper cable) during ongoing operation and carry out line diagnostics. It 
provides signal regeneration and galvanic isolation for the connected segments. 
The maximum segment length is 100 m in each case; the data transfer rate can be 
between 9.6 Kbit/s and 12 Mbit/s. 


The diagnostics repeater has connections for 3 bus segments. The cable from the 
DP master is connected to the supply terminals of the DP1 bus segment. The two 
other connections DP2 and DP3 contain the measuring circuits for determination of 
the topology and for cable diagnostics on the bus segments connected to them. Up 
to nine further diagnostics repeaters can be connected in series. 


The diagnostics repeater is handled like a DP slave in the master system. In the 
event of a fault, it sends the determined diagnostic data to the DP master. This in- 
cludes the topology of the bus segment (stations and cable lengths), the contents of 
the segment diagnostic buffers (last ten events with fault information, location, 
and cause), and the statistics data (information on the quality of the bus system). 
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In addition, the diagnostics repeater provides monitoring functions for isochro- 
nous mode. 


The diagnostic data is displayed in the navigation window of the online and diag- 
nostics view of the diagnostics repeater in the Segment diagnostics folder. System 
blocks in the user program permit line diagnostics. The system function DP_TOPOL 
triggers diagnostics on the repeater and RD_REC or RDREC is used to read the diag- 
nostic data. READ_CLK reads the CPU time and WR_REC or WRREC transfers it to the 
diagnostics repeater in order to set the time on the latter. 


The diagnostics repeater is configured and parameterized with STEP 7. You can find 
it in the hardware catalog under Network components > Diagnostics repeaters > .... 


DP/DP coupler 


The DP/DP coupler (Version 2) connects two PROFIBUS subnets to each other and 
can exchange data between the DP masters. The two subnets are electrically isolat- 
ed and can be operated at different data transfer rates up to a maximum of 12 
Mbit/s. In both subnets, the DP/DP coupler is assigned to the relevant DP master as 
a DP slave with a freely selectable station address in each case. 


The maximum size of the transfer memory is 244 bytes of input data and 244 bytes 
of output data, divisible into a maximum of 16 areas. Input areas in one subnet 
must correspond to output areas in the other. Up to 128 bytes can be transferred 
consistently. If the side with the input data fails, the corresponding output data on 
the other side is maintained at its last value. 


The DP/DP coupler is configured with STEP 7. You can find it in the hardware catalog 
under Other field devices > PROFIBUS DP > Gateways > Siemens AG > DP/DP Coupler, 
Release 2>.... 


You configure the transfer area in the device view. This shows the graphics of the 
DP/DP coupler in the top part of the working window and the configuration table of 
the interface in the bottom part. Now drag an I/O module present under the DP/DP 
coupler from the hardware catalog into the table (the modules are displayed direct- 
ly if the Filter checkbox is activated in the hardware catalog). The user data 
addresses that you specify in the module properties are in the address volume of 
the DP master. 


Configure the second part of the DP/DP coupler in the same way. Add a DP/DP cou- 
pler to the second DP master system and configure the transfer area. Make sure that 
the structure of the transfer area matches that of the first part. Inputs on one side 
correspond to outputs on the other side and vice versa. The addresses in both parts 
of the DP/DP coupler are oriented to the address assignments of the relevant master 
CPU and can differ from each other. 


DP/AS-i link: connection between PROFIBUS DP and AS-Interface 


The DP/AS-i Link 20E connects PROFIBUS DP with AS-Interface. On the PROFIBUS 
DP, the link is a modular DP slave in accordance with EN 50170. On the AS-Interface, 
it is an AS-i master in accordance with the AS-i specification V2.1. 
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Connection to the DP master is via a user data interface with 32 bytes digital inputs 
and 32 bytes digital outputs. The link allows uploading of the AS-i configuration to 
the programming device. 


The DP/AS-i Link Advanced connects PROFIBUS DP with AS-Interface. On the 
PROFIBUS DP, the link is a modular DP slave in accordance with EN 50170. On the 
AS-Interface, it is an AS-i single or double master in accordance with the AS-i spec- 
ification V3.0. 


Connection to the DP master is via a user data interface with 62 bytes digital inputs 
and 62 bytes digital outputs. A programming device can be connected via the inte- 
gral Ethernet port for commissioning, testing, and diagnostics via a web interface 
with a standard browser. The link allows uploading of the AS-i configuration to the 
programming device. 


16.4.5 Special functions for PROFIBUS DP 


You can configure the following special functions in a PROFIBUS DP master system 
if the devices are designed accordingly: 


> SYNC/FREEZE groups for synchronous output of output signals and synchronous 
reading in of input signals 


> Direct data exchange between stations on the PROFIBUS 


> Equidistant bus cycles and isochronous mode for deterministic response times 


Configuring SYNC/FREEZE groups 


The SYNC control command requests the DP slaves combined into a group to simul- 
taneously (synchronously) output the output states. The FREEZE control command 
requests the DP slaves combined into a group to simultaneously (synchronously) 
freeze the current input signal states to allow them to then be cyclically fetched by 
the DP master. The UNSYNC and UNFREEZE control commands respectively cancel 
the effects of SYNC and FREEZE. 


You can generate up to eight SYNC/FREEZE groups per DP master system which are 
to execute either the SYNC command, the FREEZE command, or both. Each DP slave 
can only be assigned to one group. 


Using the system block DPSYC_FR in the user program, you can trigger the output 
of a command to a group (see Chapter 16.5 “System blocks for distributed I/O” on 
page 665). The DP master then sends the corresponding command simultaneously 
to all DP slaves in the specified group. 


To assign a DP slave to a SYNC/FREEZE group, open its interface properties and as- 
sign the DP slave to a group under SYNC/FREEZE. You can find the list with the 
groups in the interface properties of the DP master under SYNC/FREEZE and can set 
the properties (SYNC, FREEZE, or both) there for each group. 
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Configuring direct data exchange 


In a DP master system, the DP master only controls the slaves assigned to it. With 
correspondingly designed stations, only a different station (master or intelligent 
slave, referred to as receiver or subscriber) on the PROFIBUS subnet can “listen in” 
to find out what input data a DP slave (the sender or publisher) is sending to “its” 
master. This direct data exchange is also referred to as direct communication. 


You can also use direct data exchange between two DP master systems on the same 
PROFIBUS subnet. For example, the master in master system 1 can “listen in” in this 
manner to the data of a slave in master system 2. 


A prerequisite for configuration of direct data exchange is configuration of the 
sender station with input modules. First define the partner stations. Select a part- 
ner in the Network view - with two I-slaves as partners, this must be the sender - 
and open the I/O communication tab in the configuration table in the bottom part of 
the working window. The DP slaves which have already been configured are listed 
here. The Drop the device here or select cell is present in the Partner 2 column. Click 
in this cell and select the partner station for direct data exchange from the drop- 
down list or drag the partner station from the graphic into this cell using the 
mouse. The partner station is entered in a new line in the configuration table with 
the operating mode Direct data exchange. 


Select the line with the partner station and enter the desired transfer areas in the 
inspector window under Direct data exchange in the Transfer area table. Select the 
desired module in the Partner module column from the drop-down list and define 
the input address in the receiver station, the length of the transfer area, and the 
data consistency. 


Configuring equidistant bus cycles (constant bus cycle time) 
and isochronous mode 


Constant bus cycle time 


In the normal case, of the DP master controls the DP slaves assigned to it cyclically 
and without pauses. The time intervals may vary as a result of S7 communication, 
for example if the programming device carries out control functions over the 
PROFIBUS subnet. By using constant bus cycle times it is possible to achieve, for 
example, that outputs are always controlled via DP slaves at equal intervals. The 
DP master then always starts the bus cycles at equal intervals. 


The use of constant bus cycle times is possible with the bus profiles “DP” and 
“User-defined”; SYNC/FREEZE groups must not be configured. 


Isochronous mode 


Reference is made to isochronous mode if a program is executed synchronous to 
the PROFIBUS DP cycle. In association with constant bus cycle times it is thus possi- 
ble to achieve reproducible, response times of equal duration to the process I/O, 
which include the distributed recording of signals, signal transfer over PROFIBUS, 
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and program execution including process image updating. The user program exe- 
cuted in isochronous mode is present in one of the organization blocks OB 61 to 
OB 64. The system functions SYNC_PI and SYNC_PO are available for isochronous 
updating of the process image. 


The application of constant bus cycles is a prerequisite for isochronous mode. 
Isochronous mode is only possible with a DP master integrated in the CPU as the on- 
ly active station on the PROFIBUS. 


Fig. 16.17 shows the times involved in the isochronous mode. Ti is the time re- 
quired for reading in the process values. It contains the execution time in the input 
modules or electronic modules and, in the case of modular DP slaves, the transfer 
time on the backplane bus. At the end of Ti, the input information for transfer using 
the global control command (GC) is available. The constant bus cycle time then 
commences. This is the time between two global control commands and encom- 
passes the transfer to the subnet as well as the execution of the isochronous inter- 
rupt OB. Between completion of the execution of this OB to the next global control 
command there must be time for execution of the main program. 


Isochronous mode 


Isochronous 
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GC ‘\ GC 
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transfer services equidistance 
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Change in sensor signal Output at 
at module terminal module terminal 


Fig. 16.17 Response time with constant bus cycle time and isochronous mode 


To is the time required to output the process values. It begins with the global con- 
trol command and comprises the transfer time on the subnet as well as the process- 
ing time in the output modules or electronic modules. In the case of modular DP 
slaves, the transfer time on the backplane bus is also added. 
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The minimum response time in the case of isochronous mode is the total of Ti, the 
bus cycle, and To. The maximum response time (Ti + To + 2 x bus cycle) occurs if a 
change in the input signal takes place shortly after the global control command. 


Correspondingly designed DP slaves allow a reduction in the response time thanks 
to “overlapping isochronous mode”. This involves overlapped updating of the input 
and output signals (overlapping of Ti and To). In this case, the DP slave must not ob- 
tain the Ti/To values from the subnet. If isochronous modules have both inputs and 
outputs, overlapping of Ti and To is not possible. 


Configuration of isochronous mode 


A prerequisite for configuration of isochronous mode is the constant bus cycle time 
and the corresponding functionality of the participating DP components. Following 
configuration of the DP master system with appropriate modules (CPU with integral 
DP interface as well as ET 200S and/or ET 200M DP interface modules with input/out- 
put modules with isochronous mode capability), you assign the DP master system 
(e.g. 1) and one or several process image partitions to one of the organization blocks 
OB 61 to OB 64 in the CPU properties in the Isochronous mode interrupts tab. 


To switch on the constant bus cycle time and isochronous mode, activate the Enable 
constant bus cycle time checkbox in the properties of the PROFIBUS subnet under 
Constant bus cycle time. Activate isochronous mode for the participating DP slaves 
in the Detailed overview section and, if you “open” a line with a DP slave, the isochro- 
nous mode of the individual I/O modules in the DP slave. In the Ti/To values column 
you can select the mode from a drop-down list for calculation of the Ti/To values: 


> From subnet: The currently configured DP slave obtains the Ti/To values from the 
subnet and thus has the same values as the other DP slaves which also obtain 
their values from the subnet. 


> Automatic minimum: If you manually change the Ti/To values of another DP slave 
when in this setting, any adaptations which may be necessary on the currently 
configured DP slave are carried out automatically. 


> Manual: With this setting, you manually enter the Ti/To values for the currently 
configured DP slave. 


You can also make these settings in the interface properties of the DP slave under 
Isochronous mode (Fig. 16.18). 


Each module or submodule involved in isochronous mode must be addressed in a 
process image partition TPAx. You set the process image partition for the module in 
the Device view in the module properties under I/O addresses. 


Chapter 5.6.8 “Synchronous cycle interrupts, organization blocks OB 61 to OB 64” 


on page 209 describes how you configure the organization blocks for isochronous 
mode. 
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Fig. 16.18 Activation of isochronous mode in a DP slave 


16.5 System blocks for distributed I/O 


16.5.1 System blocks for PROFIBUS DP 
The following system blocks can be used together with PROFIBUS DP: 


> DP_PRAL Trigger hardware interrupt with DP master (SFC 7) 

> DPSYC_FR Send SYNC/FREEZE commands (SFC 11) 

> DPNRM_DG Read diagnostic data from a DP standard slave (SFC 13) 
> DP_TOPOL Determine bus topology (SFC 103) 


Fig. 16.19 shows the graphic representation of the system block calls for 
PROFIBUS DP. 


In addition to the blocks listed above, you can use the following blocks with 
PROFIBUS DP and also with PROFINET IO: 


GETIO Read all inputs of a station (FB 20) 

SETIO Write to all outputs of a station (FB 21) 
GETIO_PART Read some inputs of a station (FB 22) 
SETIO_ PART Write to some outputs of a station (FB 23) 
D_ACT_DP Activate/deactivate distributed station (SFC 12) 
DPRD_DAT Read user data (SFC 14) 


DPWR_DAT Write user data (SFC 15) 


665 


16 Distributed I/O 


System blocks for PROFIBUS DP 


SFC 7 SFC 11 
Trigger hardware interrupt Send SYNC/FREEZE command 
DP_PRAL DPSYN_FR 
—_ia RET_VAL —— —REs RET_VAL —— 
— l0ID BUSY —— — LADDR BUSY —_ 
—— LADDR — GROUP 
— AL_INFO —— MODE 
SFC 13 SFC 103 
Read diagnostics data Determine bus topology 
DPNRM_DG DP_TOPOL 
—— REG RET_VAL —— —— REQ RET_VAL —— 
— LADDR RECORD: —— —R BUSY —— 
US — DP_ID DER — 
DPRI —— 


Fig. 16.19 Graphic representation of system blocks for PROFIBUS DP 


These blocks are described in Chapter 16.5.2 “System blocks for PROFIBUS DP and 
PROFINET IO” on page 668. 


DP_PRAL Trigger hardware interrupt at DP master 


DP_PRAL triggers a hardware interrupt from the user program of an intelligent 
slave for the corresponding DP master. This results in starting of organization block 
OB 40 in the program of the master CPU. 


You can use the AL_INFO parameter for a self-defined interrupt ID which is trans- 
ferred to the start information of the interrupt OB called in the DP master 
(OB40_POINT_ADDR tag). REQ = “1” triggers the interrupt request; the RET_VALand 
BUSY parameters show the job status. The job is completed when processing of the 
interrupt OB has been finished in the master CPU. 


The user data interface between DP master and intelligent DP slave can be divided 
into individual transfer areas which represent individual “modules” from the view- 
point of the master CPU. The lowest address of a transfer area is the module start 
address. You can trigger a hardware interrupt in the master CPU for each of these 
“virtual” slots. 


You specify a transfer area using the IOID and LADDR parameters from the view- 
point of the slave CPU. The start information of the interrupt OB then contains the 
addresses of the interrupt-triggering “module” from the viewpoint of the master 
CPU. 
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DPSYC_ FR Send SYNC/FREEZE commands 


DPSYC_FR sends the SYNC, UNSYNC, FREEZE, and UNFREEZE commands to a 
SYNC/FREEZE group which you have configured with the hardware configuration. 
The send procedure is triggered by REQ = “1” and is finished when BUSY signals “0”. 


In the GROUP parameter, each group occupies one bit (from bit 0 = group 1 to 
bit 7 = group 8). The commands in the MODE parameter are also organized in bits: 


> UNFREEZE if bit 2 = “1” 
> FREEZE if bit 3 = “1” 
> UNSYNC if bit 4 = “1” 
> SYNC if bit 5 = “1” 


SYNC and UNSYNC commands or FREEZE and UNFREEZE commands must not be 
triggered simultaneously in a call. 


Following a startup, SYNC mode and FREEZE mode on the DP slaves are initially 
switched off. The inputs of the DP slaves are scanned in sequence by the DP master 
and the outputs of the DP slaves are controlled; the DP slaves immediately output 
the received output signals at the output terminals. 


If you wish to “freeze” the input signals of several DP slaves at a certain time, output 
the FREEZE command to the associated group. The input signals read by the DP 
master in succession have the signal states which they had when “freezing”. These 
input signals retain their values until you use a further FREEZE command to re- 
quest the DP slaves to read in and freeze updated input signals, or until you switch 
the DP slaves back to “normal” mode using the UNFREEZE command. 


If you wish to output the output signals of several DP slaves synchronously at a cer- 
tain time, first output the SYNC command to the associated group. The addressed 
DP slaves then retain the current signals at the output terminals. You can then 
transfer the desired signal states to the DP slaves. Output the SYNC command again 
following completion of transfer; in this manner you request the DP slaves to 
connect the received output signals simultaneously to the output terminals. The DP 
slaves retain the signals at the output terminals until you connect the new output 
signals using a further SYNC command, or until you switch the DP slaves back to 
“normal” mode using the UNSYNC command. 


Note that the SYNC and FREEZE commands are still valid following a cold restart or 
warm restart. 


DPNRM_DG Read diagnostic data 


DPNRM_DG reads the diagnostic data of a DP standard slave. The read procedure is 
triggered by REQ = “1” and is finished when BUSY signals “0”. The number of read 
bytes is then present in the function value RET_VAL. Depending on the slave, the di- 
agnostic data is at least 6 bytes and a maximum of 240 bytes long. The first 240 
bytes are transferred if the diagnostic data is longer and then the corresponding 
overflow bit is set in the data. 
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The RECORD parameter describes the area in which the read data is saved. Tags with 
data types ARRAY and STRUCT, a PLC data type, or an ANY pointer with data type 
BYTE (e.g. P#DBzDBXy.x BYTE nnn) are permissible as actual parameters. 


Note that DPMRM_DG is a system function which operates asynchronously. It must 
be processed until the BUSY parameter has signal state “0”. RALRM is a system 
block which makes the data available synchronously, i.e. immediately following the 
call. 


DP_TOPOL Determine bus topology 


DP_TOPOL uses a diagnostics repeater to determine the bus topology of the DP 
master system whose ID you specify in the DP_ID parameter. The determination is 
triggered by REQ = “1” and is finished when BUSY signals “0”. You can use R = “1” 
to cancel determination of the topology. 


If an error is signaled by a diagnostics repeater, determination of the bus topology 
is prevented and this is shown in the DPR and DPRI parameters. If several diagnos- 
tics repeaters signal errors, the error message of the first one is displayed and the 
complete diagnostic information can be read with DPNRM_DG or the programming 
device. 


A distinction is made between temporary and permanent faults in the error infor- 
mation in the DPRI parameter. In certain circumstances it may not be possible to 
conclusively identify temporary faults such as a loose contact and these may disap- 
pear on their own. You must eliminate permanent faults before you call DP_TOPOL 
again to determine the topology. 


Following processing of DP_TOPOL, the determined data is available on the diag- 
nostics repeater and can be read using RDREC. The data comprises the topology of 
the bus segment (stations and cable lengths), the contents of the segment diagnos- 
tic buffers (last ten events with fault information, location, and cause), and the sta- 
tistics data (information on the quality of the bus system). 


The diagnostics repeater is described in Chapter 16.4.4 “Coupling modules for 
PROFIBUS DP” on page 659. 


16.5.2 System blocks for PROFIBUS DP and PROFINET IO 

The following system blocks can be used with PROFIBUS DP and PROFINET IO: 
GETIO Read all inputs of a station (FB 20) 

SETIO Write to all outputs of a station (FB 21) 

GETIO_PART Read some inputs of a station (FB 22) 

SETIO_PART Write to some outputs of a station (FB 23) 

D_ACT_DP Activate/deactivate distributed station (SFC 12) 

DPRD_DAT Read user data consistently (SFC 14) 

DPWR_DAT Write user data consistently (SFC 15) 
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Fig. 16.20 shows the graphic representation of the system blocks for PROFIBUS DP 
and PROFINET IO. 


System blocks for PROFIBUS DP and PROFINET IO 


FB 20 FB 21 
Read all inputs Write all outputs 
of a station of a station 
Instance data Instance data 
GETIO SETIO 
— ID STATUS —- —ID STATUS — 
— INPUTS LEN——- —LEN 
— OUTPUTS 
FB 22 FB 23 
Read some inputs Write some outputs 
of a station of a station 
Instance data Instance data 
GETIO_PART SETIO_PART 
— ID RET VAL— ——ID STATUS —— 
——{GEESEn BUSY — — OFFSET ERROR —— 
— LEN — LEN 
— INPUTS — OUTPUTS 
SFC 12 SFC 14 SFC 15 
Activate/deactivate Read user data Write user data 
distributed station consistently consistently 
D_ACT_DP DPRD_DAT DPWR_DAT 
— REQ RET_VAL—- —  LADDR RET_VAL——- — LADDR RET_VAL —— 
— MODE BUSY — RECORD —- — RECORD 
— LADDR 


Fig. 16.20 Graphic representation of system blocks for PROFIBUS DP and PROFINET IO 


GETIO Read all inputs of a station 


GETIO uses DPRD_DAT to consistently read all input data of a DP standard slave or an 
IO device or all data of an input area in the case of modular stations. The right-hand 
word of the ID parameter contains the start address of the input area to be read. 


The destination area specified with the INPUTS parameter must be exactly the same 
length as the configured length of the input area read that is also output with the 
LEN parameter. 

SETIO Write to all outputs of a station 


SETIO uses DPWR_DAT to consistently write all output data to a DP standard slave or 
IO device or all data of an output area in the case of modular stations. The 
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right-hand word of the ID parameter contains the start address of the output area 
to be written to. 


The source area specified with the OUTPUTS parameter must be exactly the same 
length as the configured length of the output area to be written to. This is why 
information in the LEN parameter is irrelevant. 


GETIO_PART Read some inputs of a station 


GETIO_PART uses UBLKMOV to consistently read some of the input data of a DP 
standard slave or IO device or some of the data of an input area in the case of mod- 
ular stations. The right-hand word of the ID parameter contains the start address of 
the input area, the OFFSET parameter contains the number of the first byte to be 
read, and the LEN parameter contains the number of bytes. 


The input bytes to be read must be addressed in the process image input in order to 
use GETIO_PART. Please ensure that the OFFSET and LEN parameters do not violate 
any boundaries with neighboring data of other stations. 


If the destination area specified by the INPUTS parameter is smaller than the input 
area read, the function only transfers as many bytes as can be written to the destina- 
tion area. If the destination area is larger, only the first LEN bytes of the area are writ- 
ten to. In both cases, no error is indicated on the ERROR parameter. ERROR only has 
signal state “1” if UBLKMOV signals an error. 


SETIO_PART Write some outputs to a station 


SETIO_PART uses UBLKMOV to consistently write some of the output data to a DP 
standard slave or IO device or some of the data of an output area in the case of mod- 
ular stations. The right-hand word of the ID parameter contains the start address of 
the output area, the OFFSET parameter contains the number of the first byte to be 
written, and the LEN parameter contains the number of bytes. 


The output bytes to be written must be addressed in the process image output in 
order to use SETIO_PART. Please ensure that the OFFSET and LEN parameters do not 
violate any boundaries with neighboring data of other stations. 


If the source area specified by the OUTPUTS parameter is smaller than the output 
area to be written, the function only transfers as many bytes as the source area con- 
tains. If the source area is larger, only the first bytes specified at the LEN parameter 
are transferred. In both cases, no error is indicated on the ERROR parameter. ERROR 
only has signal state “1” if UBLKMOV signals an error. 


D_ACT DP Activate/deactivate distributed station 


D_ACT_DP deactivates and activates stations of the distributed I/O and allows scan- 
ning of the deactivated or activated status. A distributed station can be a DP slave 
or an IO device. 


D_ACT_DP is called in the cyclic program; calling in the start-up routine is not sup- 
ported. D_ACT_DP works asynchronously, i.e. processing of a job can extend over 
several program cycles. An activation or deactivation job is started by “1” in the REQ 
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parameter. The REQ parameter must remain “1” for as long as the BUSY parameter 
has signal state “1”. The job has been completed if BUSY = “0”. 


After deactivation, a configured (and existing) station is no longer addressed by the 
DP master or the IO controller. The output terminals of deactivated output modules 
carry zero or a substitute value. The process image input of deactivated input mod- 
ules is set to “O”. 


A deactivated station can be removed from the bus without generating an error 
message; it is not signaled as faulty or missing. The calls of the asynchronous error 
organization blocks OB 85 (program execution error if the user data of the deacti- 
vated station is present in an automatically updated process image), and OB 86 (sta- 
tion failure) are omitted. You must not address the station from the program once 
it has been deactivated, since otherwise an I/O access error with calling of OB 122 
will occur with direct access operations, or the station will be signaled as not pres- 
ent when reading a data record with RDREC. 


D_ACT_DP also activates a deactivated station again. The station is configured and 
parameterized by the DP master or IO controller as with a return of station. The 
asynchronous error OBs 85 and 86 are not started when activating. If the BUSY pa- 
rameter has signal state “0” following activation, the station can be addressed from 
the user program. 


In the case of a cold restart or warm restart, the operating system of a CPU 400 auto- 
matically activates the deactivated stations and continues the startup. Because acti- 
vating a distributed station can take a long time, I/O access errors will occur that, de- 
pending on configuration, call the OB 85 I/O access error organization block until the 
activation is completed. The activation status of the distributed stations does not 
change on hot restart. 


DPRD_DAT Read user data consistently 


DPRD_DAT reads consistent user data with a length of 3 bytes or greater than 4 bytes 
from a DP standard slave or IO device. 


The LADDR parameter receives the module start address of the user data (input 
area). The RECORD parameter describes the area in which the read data is saved. 
Tags with data types ARRAY and STRUCT, a PLC data type, or an ANY pointer with 
data type BYTE (e.g. P#DBzDBXy.x BYTE nnn) are permissible as actual parameters. 


Note: If peripheral inputs (I:P) are addressed whose addresses are in the process im- 
age input (I), the process image is not updated. 


DPWR_DAT Write user data consistently 


DPWR_DAT writes consistent user data with a length of 3 bytes or greater than 
4 bytes to a DP standard slave or IO device. 


The LADDR parameter receives the module start address of the user data (output 
area). The RECORD parameter describes the area from which the transferred data is 
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read. Tags with data types ARRAY and STRUCT, a PLC data type, or an ANY pointer with 
data type BYTE (e.g. P#DBzDBXy.x BYTE nnn) are permissible as actual parameters. 


If peripheral outputs (Q:P) are addressed whose addresses are in the process image 
output (Q), the process image is not updated. 


16.5.3 System block for PROFINET IO 
The following system block can be used with PROFINET IO: 


> IP_CONF Configure PROFINET interface (SFC 104) 


Fig. 16.21 shows the graphic representation of the system block call for PROFINET 
10. 


System blocks for PROFINET IO 


SFC 104 
Configure PROFINET 
interface 
IP_CONF 
— REQ DONE — 
— LADDR BUSi—a— 
— CONF_DB ERROR —— 
STATUS —— 
ERRLOC —— 


Fig. 16.21 Graphic representation of the call of IP_CONF 


IP_CONF Configure PROFINET interface 


IP_CONF configures the integral PROFINET interface of the CPU. A prerequisite is 
that the Obtain IP address in different manner option was set during parameteriza- 
tion of the PROFINET interface with the hardware configuration when assigning the 
IP parameters. 


IP_CONF works asynchronously, i.e. processing of ajob can extend over several pro- 
gram cycles. The job is started by “1” in the REQ parameter. The REQ parameter 
must remain “1” for as long as the BUSY parameter has signal state “1”. 


The job has been completed if BUSY = “0”. The DONE parameter indicates with sig- 
nal state “1” that the job has been completed without errors. In the event of an er- 
ror, ERROR has signal state “1”. The STATUS parameter provides information on er- 
rors which have occurred and the ERR_LOC parameter identifies the source. 


You specify the diagnostic address of the PROFINET interface at the LADDR param- 
eter. The CONF_DB parameter is a pointer to the configuration data. This can be a 
data area addressed by an ANY pointer or a complete data block. It consists of a 
header containing the field type (= 0), the field ID (= 0), and the number of following 
subfields. The header is followed by the subfields. Subfields are currently defined 
for the IP parameters and the device name (Fig. 16.22). 
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CONF_DB data area 


The CONF_DB data area comprises a header Subfield for the IP parameters 
and several subfields. Currently the subfields id :=30 INT ) 
are defined for the IP parameters and the ; 
device name. len = 18 INT > Header 
mode =A INT 
field type id :=O0 INT ae BYTE 1 
field_id =O INT 500 > IP Address 
subfield_cnt :=n_ INT Subfield ipaddr_O BYTE 
; = 4 
subticlsel > esdeedars snmask_3 BYTE 
subfield_2 cee - Subnet mask 
ons Subfield-specific annals © BYTE 
subfield_n pee? router_3 BYTE 1 
" eee > Router address 
) Ifthe length for the field of the device name aa) BYTE 
is defined to be shorter, the length in the = 
header must be adapted. ; ; 
If the device name is shorter than the field, Subfield for the device names 4 
B#16#:=00 must be assigned to the byte after id =40 INT 
the device name. len = 246 INT > Header 
If B#16#:=00 is at the beginning of the device anode = INT 
name, the name will be deleted. - e * 
nos ARRAY [1..240] OF BYTE *) 


Fig. 16.22 Data structure for the IP configuration 
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17 Communication 


17.1 Overview 


Communication is understood to be the data exchange between networked sta- 
tions. A station is a device containing a module with communication capability, for 
example a programmable controller or an HMI device. The stations are connected 
either to a bus system or to a point-to-point connection. In the case of a bus system, 
all stations are connected together over one single line; in the case of a point-to- 
point connection, the connection is limited to two stations. 


The physical connection on its own - the networking - is not sufficient for commu- 
nication. A specifically defined sequence, referred to as the protocol, is required to 
exchange the data. The communication partners and the protocol are defined when 
establishing a connection. 


APLC station with a CPU 400 can exchange data with other stations over all subnets 
common to SIMATIC S7: 


> With MPI (Multi Point Interface) by means of station-external S7 basic communi- 
cation and S7 communication 


> With PROFIBUS by means of station-internal S7 basic communication and 
S7 communication 


> With Industrial Ethernet by means of station-internal S7 basic communication, 
S7 communication, and open user communication 


The connection to a subnet is made via the interfaces integrated on the CPU or via 
communication modules. Communication is controlled by the operating system of 
the CPU or CP module, possibly supported by communication functions. These are 
either system blocks which are called in the control program, or loadable function 
blocks. 


Table 17.1 Connection resources of a CPU 400 
CPU 412-1 412-2 PN 414-3 PN/DP 416-3 PN/DP 
412-2 DP 416-2 DP 
414-2 DP 416-3 DP 
414-3 DP 417-4 DP 
Number of connections 32 48 64 96 
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Note that a CPU 400 has a limited number of “connection resources”. Table 17.1 
shows the maximum number of simultaneously established connections. One con- 
nection each is reserved for connecting a programming device and an HMI station. 


Data exchange with the distributed I/O (PROFIBUS DP and PROFINET IO) is de- 
scribed in Chapter 16 “Distributed I/O” on page 631. 


A prerequisite for configuration of communication is a created project with the 
PLC stations involved in the communication. Chapter 3 “Device configuration” on 
page 62 describes how to create a project and configure the PLC stations. 


17.2 S7 basic communication 


S7 basic communication is possible as station-internal S7 basic communication 
within an automation system and as station-external S7 basic communication 
between two automation systems. 


The communication functions required for S7 basic communication are present in 
the system blocks integrated in the operating system. Connection configuration is 
not required for S7 basic communication. 


17.2.1 Basics of station-internal S7 basic communication 


Using station-internal S7 basic communication, you can exchange data within an au- 
tomation system between the central and the distributed stations, for example be- 
tween the DP master and an intelligent DP slave or between the IO controller and an 
intelligent IO device (Fig. 17.1). 


Station-internal S7 basic communication 


Central station Assigned distributed station 
CPU CPU 
In the requesting station, the transfer Operating | | Operating 7 the delivering station, the operating 
takes place with system blocks in the system system system fetches or writes the data. 
user program 
|_GET 
Data | PUT Re- Re- Data 
= sources sources 4g 4.40. 
<—_ —— 
Abort |_ABORT 
connection =i a 
_ 


PROFIBUS or PROFINET subnet 


Fig. 17.1 Principle of station-internal S7 basic communication 


675 


17 Communication 


Addressing of stations, connections 


The identification of stations is derived from the I/O address: You specify the mod- 
ule start address of a transfer area at the LADDR parameter and whether this ad- 
dress is in the input or output area at the IOID parameter. 


The communication functions establish the required connections in dynamic mode 
and - parameterizable — clear them again at the end of the job. If a connection can- 
not be established because resources are missing either in the sender or receiver, 
“Temporary shortage of resources” is signaled. Triggering of the transmission 
must then be repeated. There can only be one connection in each direction between 
two communication partners. 


By changing the block parameters during runtime, you can use a communication 
function for different connections. A communication function may not interrupt it- 
self. You can only insert, modify, or delete a program section in which a communi- 
cation function is used in STOP mode; a cold restart or warm restart must be sub- 
sequently carried out. 


User data, data consistency 


The communication functions transfer a maximum of 76 bytes as user data. 
The CPU's operating system combines the user data into blocks independent of the 
transfer direction and these blocks are data-consistent. The length of the data 
transmitted consistently depends on the block size of the “passive” CPU. 


17.2.2. Configuring of station-internal S7 basic communication 


A prerequisite for station-internal S7 basic communication is a PROFIBUS or 
PROFINET subnet. Chapter 3.4.6 “Configuring a PROFIBUS subnet” on page 81 and 
Chapter 3.4.7 “Configuring a PROFINET subnet” on page 82 describe how to create 
such a subnet. 


Particularly for station-internal S7 basic communication, configuration is unneces- 
sary since the data transfer is handled via dynamic connections. Data transfer is 
triggered in the user program by system blocks. 


17.2.3 System blocks for station-internal S7 basic communication 


The following system blocks handle data transfer for station-internal S7 basic com- 
munication: 


> IGET Read data (SFC 72) 
> I PUT Write data (SFC 73) 


> IABORT Abort connection (SFC 74) 


The program elements catalog contains the system blocks under Communication > 
Communication with iSlave/iDevice. The graphic representation of the block calls is 
shown in Fig. 17.2. 
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System blocks for station-internal S7 basic communication 


SFC 72 SFC 73 SFC 74 
Read data Write data Abort connection 
|_GET |_PUT |_ABORT 
ANY = ALY) NY ANY — REQ RET_VAL — 
— REQ RET_VAL——  —— REQ RET VAL— —IOID BUSY —— 
— CONT BUSY — — CONT BUSY — —  LADDR 
— IOID RD— -—lOID 
—— LADDR — LADDR 
— VAR_ADDR — VAR_ADDR 
— SD 


Fig. 17.2 Graphic representation of the SFCs for station-internal S7 basic communication 


GET Read data 


I_GET reads data from a distributed station. A job is triggered by REQ = “1” and 
BUSY = “0” (“Initial call”). BUSY is set to “1” during execution of the job; changes to 
the REQ parameter now no longer have an effect. BUSY is returned to “O” at the end 
of the job. If REQ is still “1”, the job is started again immediately. 


Following triggering of the read operation, the operating system in the partner de- 
vice assembles the data requested by VAR_ADDR and sends it. If an SFC is called, 
the received data is entered completely into the destination area. RET_VAL then in- 
dicates the number of transferred bytes. 


If CONT = “0”, the communication connection is cleared again. CONT = “1” retains 
the connection. The data is even read if the communication partner is at STOP. 


The RD and VAR_ADDR parameters describe the area from which the data to be sent 
is read or into which the received data is to be written. Operands, tags, or any data 
areas addressed by an ANY pointer are permissible as actual parameters. A data 
type test between the send and receive data is not carried out. 


The partner module is defined using the IOID and LADDR parameters. 


LPUT Write data 


I_ PUT writes data to a distributed station. A job is triggered by REQ =“1” and 
BUSY = “O” (“Initial call”). BUSY is set to “1” during execution of the job; changes to 
the REQ parameter now no longer have an effect. BUSY is returned to “O” at the end 
of the job. If REQ is still “1”, the job is started again immediately. 


Following triggering of the write operation, the operating system accepts all data 
from the source area into an internal buffer during the initial call and sends it to 
the partner device. The received data is written there by its operating system into 
the data area VAR_ADDR. BUSY is subsequently set to “0”. The data is even written 
if the communication partner is at STOP. 
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The SD and VAR_ADDR parameters describe the area from which the data to be sent 
is read or into which the received data is to be written. Operands, tags, or any data 
areas addressed by an ANY pointer are permissible as actual parameters. A data 
type test between the send and receive data is not carried out. 


The partner module is defined using the IOID and LADDR parameters. 


IABORT Cancel connection 


I_ ABORT aborts an existing connection. REQ = “1” triggers the job. I ABORT can on- 
ly be used to abort connections established using I_GET or I_ PUT in the own station. 


BUSY is set to “1” during execution of the job; changes to the REQ parameter now 
no longer have an effect. BUSY is returned to “0” at the end of the job. If REQ is still 
“1”, the job is started again immediately. 


17.2.4 Basics of station-external S7 basic communication 


Using station-external S7 basic communication, you can exchange data between 
PLC stations on the same MPI subnet depending on events (“MPI communication”). 
The communication functions required for this are system blocks in the CPU's op- 
erating system. The communication functions establish the connections them- 


Station-external S7 basic communication 


PLC station PLC station 
User program in the CPU CPU CPU User program in the CPU 
One-way connection: Operating | | Operating One-way connection: 
In the requesting station, the transfer system system __ In the delivering station, the operating 
takes place with system blocks in the system fetches or writes the data. 
user program 
X_GET 
Data X_PUT Data 

= & S$ ___§_——>. 

=] = nee R 

= = e- Re- 

sources sources 
Two-way connection: Two-way connection: 
Transfer with system blocks in the Transfer with system blocks in the 
user program. user program. 
X_SEND X_SEND 
Data X_RCV X_RCV Data 
+> -<+> >= -<+> 
Abort connection: Abort connection: 
X_ABORT X_ABORT 
Zi it <> <> =] — 
MPI subnet 


Fig. 17.3 Principle of station-external S7 basic communication 
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selves as required. Therefore the station-external connections are not configured in 
the connection table (Fig. 17.3). 


Addressing of stations, connections 


Stations are derived from the MPI address at the DEST_ID parameter. 


The communication functions establish the required connections in dynamic mode 
and — parameterizable —- clear them again at the end of the job. If a connection can- 
not be established because resources are missing either in the sender or receiver, 
“Temporary shortage of resources” is signaled. Triggering of the transmission 
must then be repeated. There can only be one connection in each direction between 
two communication partners. 


All actively established connections are canceled upon a transition from RUN to 
STOP. 


By changing the block parameters during runtime, you can use a communication 
function for different connections. A communication function may not interrupt it- 
self. You can only insert, modify, or delete a program section in which a communi- 
cation function is used in STOP mode; a cold restart or warm restart must be sub- 
sequently carried out. 


User data, data consistency 


These communication functions transfer a maximum of 76 bytes as user data. 
The CPU's operating system combines the user data into blocks independent of the 
transfer direction and these blocks are data-consistent. The length of the data 
transmitted consistently is a CPU-specific variable. 


If two CPUs exchange data by means of X_GET or X_PUT, the block size of the 
“passive” CPU is decisive for the data consistency of the transferred data. With a 
SEND/RCV connection, all data is transferred consistently. 


17.2.5 Configuring of station-external S7 basic communication 


A prerequisite for station-external S7 basic communication is an MPI subnet. 
Chapter 3.4.5 “Configuring an MPI subnet” on page 80 describes how to create such 
a subnet. 


Particularly for station-external S7 basic communication, configuration is unneces- 
sary since the data transfer is handled via dynamic connections. Data transfer is 
triggered in the user program by system blocks. 


17.2.6 System blocks for station-external S7 basic communication 


The following system blocks handle data transfer between different PLC stations on 
the MPI subnet: 


> X_SEND Send data (SFC 65) 
> X_RCV_ Receive data (SFC 66) 
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> X_GET Read data (SFC 67) 
> X_PUT Write data (SFC 68) 
> X_ABORT Abort connection (SFC 69) 


The system blocks can be found in the program elements catalog under 
Communication > MPI communication. The graphic representation of the calls is 
shown in Fig. 17.4. 


System blocks for station-external S7 basic communication 


SFC 65 SFC 66 
Send data Receive data 
X_SEND X_RCV 
— REQ REA —  ——iENBDII RET_VAL —— 
— CONT BUSY —— REQ ID — 
——DESialD: NDA —— 
— REQ ID RD —— 
—ae 
SFC 67 SFC 68 SFC 69 
Read data Write data Abort connection 
X_GET X_PUT X_ABORT 
— REQ RET VAL— — REQ RET VAL——- — REQ RET_VAL —— 
— CONT BUSY — — CONT BUSY — — DEST_ID BUSY —— 
— DEST ID RD —- — DEST_ID 
— VAR_ADDR — VAR_ADDR 
— 


Fig. 17.4 Graphic representation of the SFCs for station-external S7 basic communication 


X_SEND Send data 


X_SEND sends data which is received in the partner station by X_RCV. The partner 
device is specified with the MPI address at parameter DEST_ID. A job is triggered by 
REQ = “1” and BUSY = “0” (“initial call”). BUSY is set to “1” during execution of the 
job; changes to the REQ parameter now no longer have an effect. BUSY is returned 
to “O” at the end of the job. If REQ is still “1”, the job is started again immediately. 


The operating system reads all data from the source area into an internal buffer 
during the initial call and transfers it to the partner device. 


BUSY is “1” for the duration of the send procedure. BUSY if set to “O” when the part- 
ner signals that the data has been fetched and the send job is finished. 


With CONT = “0”, the connection is canceled again and the corresponding CPU re- 
sources are then available for other communication connections. With CONT = “1”, 
the connection is retained. By means of the REQ_ID parameter you can send an ID 
together with the send data which you can evaluate at X_RCV in the partner station. 


680 


17.2 S7 basic communication 


The SD parameter describes the area from which the data to be sent is read. Oper- 
ands, tags, or any data areas addressed by an ANY pointer are permissible as actual 
parameters. A data type test between the send and receive data is not carried out. 


X_RCV_ Receive data 


X_RCV receives data which was sent by the partner station by X_SEND. The received 
data is saved in an internal buffer. Several send operations can be saved in a queue 
in the chronological order of arrival. 


You use EN_DT = “0” to check that data has been received; NDA is then “1”, RET_VAL 
shows the number of bytes of received data, and REQ ID shows the same assign- 
ment as the corresponding parameter of X_SEND. With EN_DT = “1”, the system 
function transfers the initially entered (oldest) sent data completely into the desti- 
nation area; NDA is then “1” and RET_VAL shows the number of transmitted bytes. 
If no data is present in the internal queue when EN_DT = “1”, NDA is then “0”. 


Upon a cold restart or warm restart, all data waiting for sending in the queue is re- 
jected. 


Upon cancellation of a connection and upon a hot restart, the oldest entry in the 
queue is retained if it has already been “scanned” with EN_DT = “0”, otherwise it is 
rejected like all other entries in the queue. 


The RD parameter describes the area into which the received data is written. Oper- 
ands, tags, or any data areas addressed by an ANY pointer are permissible as actual 
parameters. 


A data type test between the send and receive data is not carried out. If the received 
data is irrelevant, an “empty” ANY pointer (NIL pointer) is permissible at the RD pa- 
rameter. 


X_GET Read data 


X_GET reads data from the partner station. A job is triggered by REQ = “1” and 
BUSY = “0” (“Initial call”). BUSY is set to “1” during execution of the job; changes to 
the REQ parameter now no longer have an effect. 


BUSY is returned to “0” at the end of the job. If REQ is still “1”, the job is started 
again immediately. 


Following triggering of the read operation, the operating system in the partner de- 
vice assembles the data requested by VAR_ADDR and sends it. When the communi- 
cation function is called, the received data is entered completely into the destina- 
tion area specified at the RD parameter. RET_VAL then indicates the number of 
transferred bytes. 


If CONT = “0”, the communication connection is cleared again. CONT = “1” retains 
the connection. The data is even read if the communication partner is at STOP. 


The RD and VAR_ADDR parameters describe the area from which the data to be sent 
is read or into which the received data is to be written. Operands, tags, or any data 
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areas addressed by an ANY pointer are permissible as actual parameters. A data 
type test between the send and receive data is not carried out. 


X_PUT Write data 


X_PUT writes data to a partner station. A job is triggered by REQ = “1” and BUSY = 
“0” (“Initial call”). BUSY is set to “1” during execution of the job; changes to the REQ 
parameter now no longer have an effect. 


BUSY is returned to “0” at the end of the job. If REQ is still “1”, the job is started 
again immediately. 


Following triggering of the write operation, the operating system accepts all data 
from the source area specified at the SD parameter into an internal buffer during 
the initial call and sends it to the partner device. The received data is written there 
by its operating system into the data area specified at the VAR_ADDR parameter. 
BUSY is subsequently set to “0”. 


The data is even written if the communication partner is at STOP. 


The SD and VAR_ADDR parameters describe the area from which the data to be sent 
is read or into which the received data is to be written. Operands, tags, or any 
data areas addressed by an ANY pointer are permissible as actual parameters. 
A data type test between the send and receive data is not carried out. 


X_ABORT Cancel connection 


X_ABORT aborts an existing connection. REQ = “1” starts the job. X_ABORT can only 
be used to abort connections established using X_SEND, X_GET, or X_PUT in the 
own station. 


17.3. S7 Communication 


17.3.1 Basics 


Using S7 communication you can transfer larger data quantities between PLC sta- 
tions. The stations are connected to one another over an Ethernet subnet. The com- 
munication connections are static; they are configured in the connection table. 


S7 communication comprises communication functions for data exchange via a 
one-way or two-way connection, for controlling the operating state in the partner 
station, for scanning the status of connections, and for sending data to a printer 
(Fig. 17.5). 


For a CPU 400, the communication functions are system function blocks (SFB) 
which are integrated in the CPU's operating system. They can be called as a single 
instance with own data block or - in a function block - as a local instance. The in- 
stance data blocks of the system function blocks used are stored and displayed in 
the project tree under Program blocks > System blocks > Program resources. 
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$7 communication 


Send print data: 
Control printer via CP 


CP with printer 
PRINT 


| 
I 


PLC station PLC station 
Connection table CPU CPU Connection table 
{ ; Operating | | Operating { ' 
system system 
User program in the CPU User program in the CPU 
One-way connection: One-way connection: 
In the requesting station, the transfer In the delivering station, the operating 
takes place with standard blocks in system fetches or writes the data. 
the user program 
Data GET/PUT Data 

= & 4 > 
Two-way connection: Two-way connection: 
Transfer with standard blocks in Transfer with standard blocks in 
the user program. the user program. 

USEND/URCV USEND/URCV 

Data BSEND/BRCV BSEND/BRCV Data 
— - areal a i aa 
Control functions: 
Start and stop the partner device The controlled station performs 
STARTISTOPIRESUME a startup or enters the STOP state. 

al & > 
Monitoring functions: 
eee! eee SERS ee The monitored station provides 
the partner device 

the operating status on request or 
STATUSIUSTATUS transmits it without being prompted. 

=< 
Monitoring function: 
pcemcone con eas Re- Re- No action in the partner station. 

CONTROL sourc- sourc- 

es es 


No partner station available. 


(The printer is the communication 
partner.) 


Ethernet subnet 


Fig. 17.5 Communication functions for $7 communication 


683 


17 Communication 


17.3.2 Configuring S7 communication 


A prerequisite for S7 communication is a PROFINET subnet. Chapter 3.4.7 “Config- 
uring a PROFINET subnet” on page 82 describes how to create such a subnet. 


Configure connection 


You configure a connection between two PLC stations in the Network view of the 
hardware configuration. Click on the Connections button in the toolbar of the work- 
ing window and set the connection type S7 connection in the adjacent drop-down 
list. Then select a bus interface of one PLC station and drag it with the right mouse 
button to a same type of bus interface in the partner station. The two interfaces are 
networked with the corresponding subnet and an S7 connection is created. 


The connection table is present in the bottom part of the working window. 
The S7 connection is listed in the Connections tab. You can set the columns to be dis- 
played: Right-click in a column title and then select the Show/hide columns com- 
mand from the shortcut menu. 


A communication connection is specified by a connection ID for every communica- 
tion partner. STEP 7 assigns the connection ID when compiling the connection ta- 
ble. You use the “Local ID” for parameterization of the communication functions in 
the module from which the connection is considered and the “Partner ID” for pa- 
rameterization of the communication functions in the partner module. 


It is possible to use the same logical connection for different send/receive jobs. 
To distinguish them, you must specify a job ID in addition to the connection ID in 
order to define the association between the send and receive blocks. 


You can change the standard name assigned by STEP 7 to a connection: In the con- 
nection table, double-click in the Local connection name column on the cell with the 
name and enter a different name. 


If you select a connection in the connection table, the inspector window shows the 
properties of this connection in the Properties tab. Among other options, you can 
use Special connection properties to set which communication partner is to initiate 
the active connection establishment. 


Initialization 


S7 communication must be initialized in the startup so that the connection can be 
established to the communication partner. Initialization takes place in the CPU for 
which the Active connection establishment attribute is activated. To do this, you call 
up the communication blocks used in cyclic mode in a startup OB and supply the 
parameters (if present) as follows: 


> REQ = FALSE 


> ID =Local connection ID from the connection table 
(data type WORD W#16#xxxx) 


> R_ID=Job ID which you define for a “pair of blocks” 
(data type DWORD DW#16#xxxx_xxxx) 
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The blocks must be repeatedly called up in a program loop until the DONE param- 
eter has signal state “1”. The ERROR and STATUS parameters provide information 
on any errors and the job status. 


For the CPU 400, the communication buffers are created on the first call of the GET, 
PUT, USEND, and URCV communication blocks to ensure consistency; these define 
the maximum data amount per transfer for all subsequent calls until the next start- 


up. 


Cyclic mode 


In cyclic mode, you can call the communication blocks with their absolute name 
and control data transfer with the REQ and EN_R parameters. You must evaluate the 
results at the NDR, DONE, ERROR, and STATUS parameters immediately after each 
execution of a communication block since they only remain valid until the next call. 


17.3.3 One-way data exchange 


In the case of one-way data exchange, the call of the communication block is only 
present in one CPU. In the partner CPU, the operating system handles the required 
communication functions. 


The following blocks are available for one-way data exchange: 


> GET Read data from a partner CPU (SFB 14) 
> PUT Write data to a partner CPU (SFB 15) 


The blocks are located in the program elements catalog under Communication > S7 
communication. The graphic representation of the block calls is shown in Fig. 17.6. 


Standard blocks for one-way S7 communication 


SFB 14 SFB 15 
Read data Write data 
Instance data Instance data 
GET, 
Any - Any Any - Any 

—FREO! NDR— -—— REQ DONE —— 
—f ERROR —- ——ID ERROR —— 
— ADDR _1 STATUS —- — ADDR_1 STATUS —— 
— ADDR 2 — ADDR _2 
— ADDR 3 — ADDR _3 
— ADDR_4 — ADDR 4 
— on — 
— RD 2 —SD_2 
— — 
— RD 4 — SD 4 


Fig. 17.6 Communication functions for one-way S7 communication 
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GET Read data from a partner CPU 
PUT Write data to a partner CPU 


The data read using GET is combined in the partner CPU by the operating system; 
the data written using PUT is distributed by the operating system in the partner 
CPU. A send or receive (user) program is not required in the partner CPU. The part- 
ner CPU can perform the required communications services both in RUN and STOP. 
The size of the data blocks transmitted consistently depends on the (server) CPU 
used. 


A positive edge at the REQ parameter starts the data exchange. You supply the 
ID parameter with the connection ID defined by STEP 7 in the connection table. 


The block signals with “1” at the DONE or NDR parameter that the job has been com- 
pleted without errors. Any errors are signaled by “1” at the ERROR parameter. 
The STATUS parameter shows with an assignment which is not zero either a warn- 
ing (ERROR = “0”) or an error (ERROR = “1”). You must evaluate the DONE, NDR, 
ERROR, and STATUS parameters after every block call. 


By means of the ADDR_n parameter, you specify the tag or area in the partner device 
from which you wish to fetch data or to which you wish to send data. The memory 
areas at ADDR_n must agree with the corresponding areas at SD_n or RD_n. Use the 
parameters without gaps, beginning with 1. You do not supply parameters which 
are not required. 


17.3.4 Two-way data exchange 


In the case of two-way data exchange, you require a send block and a receive block 
at each end of a connection. Both blocks have the connection IDs which are present 
in the same line in the connection table. You can also use several “pairs of blocks” 
which are then distinguished by the job ID. 


The following blocks are available for two-way data exchange: 


> USEND Uncoordinated sending of a data packet (SFB 8) 

> URCV Uncoordinated receiving of a data packet (SFB 9) 

> BSEND Send a data block with a length of up to 64 KB (SFB 12) 
> BRCV_ Receive a data block with a length of up to 64 KB (SFB 13) 


The blocks are located in the program elements catalog under Communication > S7 
communication. The graphic representation of the block calls is shown in Fig. 17.7. 


USEND Uncoordinated sending of data 
URCV_ Uncoordinated receiving of data 


The SD_n and RD_n parameters are used to specify the tag or the area you want to 
transfer. The send area SD_n must correspond to the respective receive area RD_n. 
Use the parameters without gaps, beginning with 1. Do not supply parameters that 
are not required. 
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Standard blocks for two-way S7 communication 


SFB 8 
Send data uncoordinated 


Instance data 


SFB 9 
Receive data uncoordinated 


Instance data 


USEND URCV 
Any Any 
— REQ DONES—  —gENER NDR — 
— aD ERROR —- —HID ERROR —— 
— RID STATUS —- ——R1ID STATUS —— 
—sD1 — RD1 
— sp 2 — RD 2 
— — re 
— sp 4 — RD 4 
SFB 12 SFB 13 
Send data block by block Receive data block by block 
Instance data Instance data 
BSEND BRCV 
Any Any 

— REQ DONE; — ——gENER NDR — 
—R ERROR —- —ID ERROR —— 
—ab STATUS —- — RID STATUS —— 
—RID — RD1 
—SD1 — LEN 
— EN 


Fig. 17.7 Communication functions for two-way S7 communication 


A positive edge at the REQ parameter starts the data exchange, a positive edge at the 
R parameter aborts it. A “1” at the EN_R parameter signals the readiness to receive 
and a current job can be aborted by “0”. 


If the NDR parameter has assumed the value “1” following data transfer, call the 
block again, but with EN_R = “0” this time in order to prevent the receive area from 
being overwritten by new data during data evaluation. 


You supply the ID parameter with the connection ID defined by STEP 7 in the con- 
nection table for both the local and partner devices (the two IDs can be different). 
Use R_ID to define a freely-selectable yet unique job ID which must be the same for 
the send and receive blocks. In this manner, several pairs of send and receive blocks 
can use a single logical connection (specified by means of ID). 


With a CPU 400, on first call the connection is specified by the assignment of the 
parameters ID and R_ID until the next cold start or warm restart. 


The block signals with “1” at the DONE or NDR parameter that the job has been com- 
pleted without errors. Any errors are signaled by “1” at the ERROR parameter. 
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The STATUS parameter shows with an assignment which is not zero either a warn- 
ing (ERROR = “0”) or an error (ERROR = “1”). 


BSEND _ Block-oriented sending 
BRCV_ Block-oriented receiving 


At the SD_norRD_n parameter you specify a pointer to the first byte of the data area 
(when called for the first time, the length of this actual parameter determines the 
maximum size of the communication buffer, it is not evaluated with further calls); 
the number of bytes of the data to be currently sent or received is present at the LEN 
parameter. 


The data volume transferred can be up to 64 KB; the transfer process is carried out 
in blocks asynchronous to execution of the user program. The LEN parameter is up- 
dated after every received block. 


A positive edge at the REQ parameter starts the data exchange, a positive edge at the 
R parameter aborts it. A “1” at the EN_R parameter signals the readiness to receive 
and a current job can be aborted by “0”. 


If the NDR parameter has assumed the value “1” following data transfer, call the 
block again, but with EN_R = “0” this time in order to prevent the receive area from 
being overwritten by new data during data evaluation. 


You supply the ID parameter with the connection ID defined by STEP 7 in the con- 
nection table for both the local and partner devices (the two IDs can be different). 
Use R_ID to define a freely-selectable yet unique job ID which must be the same for 
the send and receive blocks. In this manner, several pairs of send and receive blocks 
can use a single logical connection (specified by means of ID). 


With a CPU 400, on first call the connection is specified by the assignment of the pa- 
rameters ID and R_ID until the next cold start or warm restart. 


The block signals with “1” at the DONE or NDR parameter that the job has been com- 
pleted without errors. Any errors are signaled by “1” at the ERROR parameter. The 
STATUS parameter shows with an assignment which is not zero either a warning 
(ERROR = “O”) or an error (ERROR = “1”). 


17.3.5 Control functions 

The following system blocks are available for controlling a partner device: 
> START Perform a cold or warm restart in the partner device (SFB 19) 
> STOP Switch the partner device to the STOP status (SFB 20) 

> RESUME Perform a hot restart on the partner device (SFB 21) 


No user program is required for executing the function in the partner device. The 
program elements catalog contains the blocks under Communication > S7 commu- 
nication. The graphic representation of the block calls is shown in Fig. 17.8. 
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System blocks for controlling the partner device 


SFB 19 SFB 20 SFB 21 

Perform a cold or warm Stop the partner device Hot restart of 

restart of the partner device the partner device 

Instance data Instance data Instance data 
START STOP RESUME 
Any Any 
— REO! DONE —— 

—FREO! DONE — — REQ DONE —- __ ID ERROR — 
— ID ERROR —- ——ID ERROR ——- __ P| NAME STATUS —— 
— PI_NAME STATUS —— —— PINAME STATUS —-  __ ARG 
— ARG — |O_STATE — 10 STATE 
— 10 STATE 


Fig. 17.8 Communication functions for controlling the partner device 


Common parameters 


A positive edge at the REQ parameter starts the data exchange. You supply the ID 
parameter with the connection ID defined by STEP 7 in the connection table. 


The block signals with “1” at the DONE parameter that the job has been completed. 
Any errors are signaled by “1” at the ERROR parameter. The STATUS parameter 
shows with an assignment which is not zero either a warning (ERROR = “O”) or an 
error (ERROR = “1”). You must evaluate the DONE, ERROR and STATUS parameters 
after every block call. 


You supply the parameter PI_ NAME with a field tag with the content “P_PROGRAM” 
(ARRAY [1..9] OF CHAR). The IO_STATE parameter is irrelevant and is not supplied. 


START Perform a cold or warm restart of the partner device 


START performs a cold or warm restart in the partner device. Prerequisite is that the 
partner device is at STOP and that the mode switch is set to RUN. 


If you do not supply the parameter ARG, a warm restart is triggered in the partner 
device; if ARG is assigned the value “C”, a cold restart is triggered if this is allowed 
in the partner device. 


STOP Stop the partner device 


STOP places the partner device in STOP mode. A prerequisite for error-free job pro- 
cessing is that the partner device is not in STOP mode. 


RESUME. Hot restart of the partner device 


RESUME performs a hot restart in the partner device. Prerequisite is that the part- 
ner device is at STOP, that the mode switch is set to RUN, and that a hot restart is 
permissible at this time. 


The ARG parameter is not supplied. 
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17.3.6 Monitoring functions 


The following system blocks are available as monitoring functions with S7 commu- 
nication: 


> STATUS Scan the status of the partner device (SFB 22) 
> USTATUS Receive the status of the partner device (SFB 23) 


> CONTROL Scan the status of a communication instance (SFC 62) 


The program elements catalog contains the system blocks under Communication > 
S7 communication. Fig. 17.9 shows the graphic representation of the block calls. 


STATUS Scan status of the partner device 


STATUS retrieves the status of the partner device and displays it in the parameters 
PHYS (physical status), LOG (logic status), and LOCAL (operating state if the part- 
ner device is an S7 CPU). 


A positive edge at the REQ parameter starts the scan. You supply the ID parameter 
with the connection ID defined by STEP 7 in the connection table. 


The block signals with “1” at the NDR parameter that the job has been completed 
without errors. Any errors are signaled by “1” at the ERROR parameter. The STATUS 
parameter shows with an assignment which is not zero either a warning (ERROR = 
“O”) or an error (ERROR = “1”). You must evaluate the NDR, ERROR and STATUS pa- 
rameters after every block call. 


USTATUS The status of the partner device is received 


USTATUS receives the status of the partner device, which it sends without being re- 
quested on change. The device status is displayed in the parameters PHYS (physical 
status), LOG (logic status), and LOCAL (operating state if the partner device is an 
S7 CPU). 


Monitoring functions in $7 communication 


SFB 22 
Scan status of 
the partner device 


Instance data 


SFB 23 
Receive status of 
the partner device 


Instance data 


SFC 62 
Scan status of a 
communication instance 


STATUS USTATUS CONTROL 
Any Any 

—ENR RET_VAL — 

— REQ NDR — —ENR NDR— __j pp a 
—ID ERROR — —ID ERROR— __ ogeceq oe 
— PHYS STATUS —- — PHYS STATUS — , x 
—_ hes es |_STATE — 
— LOCAL — LOCAL feo — 
|_ STATUS — 


Fig. 17.9 Communication function for monitoring of connection 
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Readiness to receive is signaled with signal state “1” at the EN_R parameter. You 
supply the ID parameter with the connection ID defined by STEP 7 in the connection 
table. 


The block signals with “1” at the NDR parameter that the job has been completed 
without errors. Any errors are signaled by “1” at the ERROR parameter. The STATUS 
parameter shows with an assignment which is not zero either a warning (ERROR = 
“O”) or an error (ERROR = “1”). You must evaluate the NDR, ERROR and STATUS pa- 
rameters after every block call. 


CONTROL Scan the status of a communication instance 


CONTROL determines the status of a communication instance and the relevant con- 
nection in the local device. You specify the instance data block of the system block 
at the I DB parameter. If the system block is called as local instance, specify the 
number of the local instance in the OFFSET parameter (0 if there is no local in- 
stance, 1 for the first local instance, 2 for the second one, and so on). 


Signal status “1” at parameter EN_R displays the status of the communication in- 
stance specified at parameter I_DB. The I_TYP, I STATE, I CONN, and I_STATUS pa- 
rameters provide information on the status of the local communication instance. 


Any errors are signaled by “1” at the ERROR parameter. The STATUS parameter 
shows with an assignment which is not zero either a warning (ERROR = “O”) or an 
error (ERROR = “1”). You must evaluate the ERROR and STATUS parameters after ev- 
ery block call. 


17.3.7 Send print data 


The PRINT system block (SFB 16) sends data to a printer. The program elements cat- 
alog contains the system block under Communication > S7 communication. Fig. 
17.10 shows the graphic representation of the block call. 


Send data to a printer 


SFB 16 
Send data to a printer 
Instance data 


PRINT 

Any 
—— REQ DONE —— 
— ID ERROR —— 
—— PRN_NR STATUS —— 
—— FORMAT 
— Spal 
— Bir 
— Bs 
— sD_4 


Fig. 17.10 Send print data to a printer 
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PRINT Send print data 


PRINT sends data including a formatting command to a printer connected to a com- 
munication module, e.g. a CP 441 module, on the PLC station. 


A positive edge at the REQ parameter starts the data exchange with the printer se- 
lected by the parameters ID and PRN_NR. The block indicates with DONE = “1” that 
data transmission has ended without errors. Any errors are signaled by “1” at the 
ERROR parameter. The STATUS parameter shows with an assignment which is not 
zero either a warning (ERROR = “0”) or an error (ERROR = “1”). You must evaluate 
the DONE, ERROR and STATUS parameters after every block call. 


At the FORMAT parameter, you specify the characters to be printed in the STRING 
data type. You can include format descriptions for up to four tags in this string, 
which you specify in the parameters SD_1 to SD_4. Use the parameters without 
gaps, beginning with 1; do not assign unrequired parameters. You can transfer a 
maximum of 420 bytes per print job (the sum of FORMAT and all tags). 


17.4 Open user communication 


17.4.1 Basics 


Open user communication (“Open communication via Industrial Ethernet”) trans- 
fers data between two devices connected to the Ethernet subnet. Communication 
can be implemented using the TCP native protocol in accordance with RFC 793, 
the ISO-on-TCP protocol in accordance with RFC 1006, or the UDP protocol in accor- 
dance with RFC 768. 


Configuring open user communication 


The following are required before data can be transferred with open user commu- 
nication: 


> In the case of the TCP native and ISO-on-TCP protocols, a connection must be 
established to the communication partner (“connection-oriented protocols”) 


> In the case of the UDP protocol, a connection must be established to the com- 
munication layer of the CPU operating system (“connectionless protocol”). 
The partner is then addressed when the relevant function block is called. 


The connection is configured via a data area (not using the connection table). The 
necessary data structures are stored in the PLC data type TCON_PAR, which the 
function blocks use for establishing and terminating the connection. The data con- 
tains the connection ID, which defines a specific connection and the associated 
function block calls, and the information on the protocol used. 


Establishment of the connection to the partner or setting up of the communication 
access point is handled by the TCON communication function that you call in the 
main program of both partner devices. Data can be transferred in parallel in both 
directions over an established connection. Several connections can exist on one 
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Open user communication 


PLC station PLC station 
User program in the CPU CPU CPU User program in the CPU 
Establish and clear connection Operating | | Operating Establish and clear connection 
TCON system system TCON 
TDISCON TDISCON 
eel __ TCON_PAR TCON_PAR __ Us 
al = > = 
Data transfer with the TCP native and Re- Re Data transfer with the TCP native and 
ISO-on-TCP protocols sources sources  [SO-on-TCP protocols 
TSEND TSEND 
Data TRCV TRCV Data 
pn cl ee ae A = 
Data transfer with the Data transfer with the 
UDP protocol UDP protocol 
TUSEND TUSEND 
Data TURCV TURCV Data 
7” __ TADD_PAR TADD_PAR__ E 
se Seren (egos) i Eg 
Ethernet subnet | | 


Fig. 17.11 Principle of open user communication 


physical line. The TDISCON communication function cancels the connection again 
and thus releases the resources used (Fig. 17.11). 


The TSEND and TRCV communication functions transfer data using the TCP native 
or ISO-on-TCP protocol. Data transfer with the UDP protocol requires the TUSEND 
and TURCV communication functions. When calling these communication func- 
tions, you specify the address of the partner device in a data area. 


Calling the communication functions 


The communication functions for open user communication work asynchronously, 
i.e. job execution can take several program cycles under certain circumstances. You 
can call the communication functions in the main program and control data trans- 
fer with the REQ and EN_R parameters. You must evaluate the results at the BUSY, 
NDR, DONE, ERROR, and STATUS parameters immediately after each execution 
since they only remain valid until the next call. 


17.4.2 Establishing and terminating connections 


Before data can be transferred with open user communication, a connection must 
be established to the partner device (in the case of TCP native and ISO-on-TCP) or 
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to the communication layer of the operating system (in the case of UDP). You can 
use the following standard blocks for this purpose: 


> TCON (FB 65) 
Establish connection to the communication partner or the communication layer 
of the operating system 


> TDISCON (FB 66) 
Terminate communication connection 


The communication functions can be found in the program elements catalog under 
Communication > Open user communication. The graphic representation of the 
block calls is shown in Fig. 17.12. 


Standard blocks for open user communication 


FB 65 FB 66 
Establish connection Terminate connection 
Instance data Instance data 
TCON TDISCON 
— REQ DONE — — REQ DONE — 
—ID BUSY —-  ——ID BUSY — 
— CONNECT ERROR — ERROR — 
STATUS — STATUS — 
FB 63 FB 64 
Send data with Receive data with 
logic connection logic connection 
Instance data Instance data 
TSEND TRCV 
—FREO DONE — —ENR NDR — 
— ID BUSya— ——D BUSY — 
— iin ERROR —- —— LEN ERROR —— 
— DATA Siaiwss— ——DAIA STATUS — 
RCVD_LEN — 
FB 67 FB 68 
Send data with UDP Receive data with UDP 
Instance data Instance data 
TUSEND TURCV 
— REG) DONES— ——#ENRR NDR — 
— i BuSa—_— —id BUSY —— 
— LEN ERROR —- -——LEN ERROR —— 
— DATA STATUS — — DATA STATUS —— 
—— ADDR — ADDR RCVD_LEN —— 


Fig. 17.12 Graphic representation of blocks for open user communication 
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TCON Establish connection 


TCON creates the conditions for open user communication. The parameters re- 
quired for this are located in a data area that has the structure of the data type 
TCON_PAR. 


When using the TCP native and ISO on TCP protocols, a connection is established to 
the communication partner. The station for which “Active connection setup” is en- 
tered establishes the connection. The partner station must then be designated as 
“passive”. This designation is independent of the direction of transfer of the data. 


The connection is monitored and maintained by the CPU's operating system. In the 
event of a break in connection, the active partner attempts to re-establish the con- 
nection without having to call TCON again. TDISCON terminates the communica- 
tion connection with the CPU at STOP or in the case of POWER OFFI/ON. 


If the UDP protocol is used, TCON sets up a local communication access point that 
represents the connection between the user program and the communication layer 
of the operating system. No connection is made to the connection partner. 


Designate the communication connection by assigning the ID parameter. The spec- 
ification must correspond to the variable id in the connection data. You specify the 
connection data with the pointer at the CONNECT parameter. 


In the initial state, the REQ, BUSY, DONE, and ERROR parameters have signal state 
“0”. Arising edge at the REQ parameter starts the establishment of the connection. 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, DONE = “1”, and ERROR = “0”. If the job contains errors, then BUSY = 
“0”, DONE = “0”, and ERROR = “1”. The error is then specified at the STATUS 
parameter. BUSY, DONE, and ERROR are reset to “0” if REQ is returned to “O”. 


TDISCON Terminate communication connection 


TDISCON terminates the requirements for open user communication. The connec- 
tion to the communication partner is terminated or the communication access 
point is closed. Designate the communication connection by assigning the ID 
parameter. The specification must correspond to the variable id in the connection 
data. 


In the initial state, the REQ, BUSY, DONE, and ERROR parameters have signal 
state “O”. Arising edge at the REQ parameter starts terminating of the connection. 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, DONE = “1”, and ERROR = “0”. If the job contains errors, then BUSY = 
“0”, DONE = “0”, and ERROR = “1”. The error is then specified at the STATUS 
parameter. BUSY, DONE, and ERROR are reset to “0” if REQ is returned to “O”. 


TCON_PAR Structure of the connection data 


The data type TCON_PAR (UDT 65) contains the structure of the connection data ei- 
ther for the communication connection to the partner device (protocols TCP native 
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and ISO-on-TCP) or for the connection to the communication layer of the local op- 
erating system (UDP protocol). 


You require a data block with this structure for each connection. For each connec- 
tion, you can use your own type data block by creating the data block based on 
TCON_PAR, or you can combine the data blocks in a shared global data block (Table 
17.2). 


17.4.3. Data transfer with TCP native or ISO-on-TCP 


The following standard blocks are available for data transfer with the TCP native 
and ISO-on-TCP connection-oriented protocols: 


> TSEND Send data with logic connection (FB 63) 
> TRCV Receive data with logic connection (FB 64) 


The communication functions can be found in the program elements catalog under 
Communication > Open user communication. The graphic representation of the 
block calls is shown in Fig. 17.12. 


You have to establish a connection to the partner station with TCON before trans- 
ferring the data. Data can be exchanged simultaneously in both directions over the 
connection with TSEND and TRCV. 


TSEND Send data with logic connection 


TSEND sends data with the TCP native or ISO on TCP protocol via an existing com- 
munication connection. 


Designate the communication connection by assigning the ID parameter. The spec- 
ification must agree with the variable id in the connection data. Specify the send 
mailbox with the pointer at the DATA parameter. 


In the initial state, the REQ, BUSY, DONE, and ERROR parameters have signal state 
“OQ”. Start data transfer with a rising edge at the REQ parameter. On the initial call 
with “1”, the data is fetched from the area specified by the DATA parameter. The 
number of bytes specified at the LEN parameter is sent. 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, DONE = “1”, and ERROR = “0”. If the job contains errors, then BUSY = 
“0”, DONE = “0”, and ERROR = “1”. The error is then specified at the STATUS param- 
eter. BUSY, DONE, and ERROR are reset to “0” if REQ is returned to “O”. 


The data in the send area can then be modified again when either DONE or ERROR 
has signal state “1”. 


TRCV_ Receive data with logic connection 


TRCV receives data with the TCP native or ISO on TCP protocol via an existing com- 
munication connection. 
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Table 17.2 Structure of data type TCON_PAR 
Byte Parameter Data type Description 
Oand 1 block_length WORD Length of TCON_PAR (fixed at 64 bytes) 
2 and 3 id WORD Connection ID 
4 connection_type BYTE Protocol variant 
BH16#11 : TCP 
B#16#12 : ISO-on-TCP 
B#16#13 : TCP (compatibility mode) 
With UDP : B#16#13 
5 active_est BOOL Type of connection establishment 


FALSE : Passive connection establishment 
TRUE : Active connection establishment 


With UDP : FALSE 


6 local_device_id BYTE Communication module ID 

7 local_tsap_id_len BYTE Length of parameter local_tsap_id 

8 rem_subnet_id_len BYTE B#16#00 

9 rem_staddr_len BYTE Length of parameter rem_staddr 
With UDP : B#16#00 

10 rem_tsap_id_len BYTE Length of parameter rem_tsap_id 
With UDP : B#16#00 

11 next_staddr_len BYTE Length of parameter next_staddr 
With UDP : B#16#00 

12 to 27 local_tsap_id ARRAY [1..16] OF BYTE | Depending on connection: 
local port number or local TSAP ID 
With UDP : local port number 

28 to 33 rem_subnet_id ARRAY [1..6] OF BYTE B#16#00 

34 to 39 rem_staddr ARRAY [1..6] OF BYTE IP address of remote partner 
With UDP : B#16#00 

40 to 55 rem_tsap_id ARRAY [1..16] OF BYTE | Depending on connection: 
remote port number or remote TSAP ID 
With UDP : B#16#00 

56 to 61 rem_staddr ARRAY [1..6] OF BYTE CP slot 
With UDP : B#16#00 

62 and 63 | spare WORD W#16#0000 
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Designate the communication connection by assigning the ID parameter. The spec- 
ification must agree with the variable id in the connection data. Specify the receive 
mailbox with the pointer at the DATA parameter. 


If the LEN parameter has 0, the length specified in the DATA parameter is used. 
After a data block has been received, the number of bytes received is made available 
at the RCVD_LEN parameter and NDR is set to signal state “1”. 


With the TCP native protocol, neither the length of the message frame nor its start 
or end is transferred. So that the number of bytes sent is correctly received, 
the LEN parameter at the receive block must be assigned the same value as the 
LEN parameter at the send block. 


If a larger value has been selected for LEN at the receive block, part of the following 
message frame (from the next job) will also be received. NDR is only set to “1” if the 
parameterized length has been reached. 


If a smaller value has been selected for LEN, NDR is set to “1” when the parameter- 
ized length is reached and the RCVD_LEN parameter is assigned the number of re- 
ceived bytes. With each subsequent call, another data block is received. 


With the ISO-on-TCP protocol, information about the length and end of a mes- 
sage frame is sent. If LEN at the receive block is larger than at the send block, 
the sent data is received, NDR is set to “1” and the number of received bytes is 
written in RCVD_LEN. If LEN is smaller, an error message is issued: ERROR = “1”, 
STATUS = W#16#8088. 


TRCV only receives data if the EN_R parameter has signal state “1”. 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, NDR = “1”, and ERROR = “0”. If the job contains errors, BUSY = “0”, 
NDR = “O”, and ERROR = “1”. The error is then specified at the STATUS parameter. 
BUSY, NDR, and ERROR are reset to “0” if EN_R is returned to “O”. 


The data in the receive mailbox is consistent if NDR has signal state “1”. 


17.4.4 Data transfer with UDP 


The following standard blocks are available for data transfer with the connection- 
less UDP protocol: 


> TUSEND Send data with UDP (FB 67) 
> TURCV Receive data with UDP (FB 68) 


The communication functions can be found in the program elements catalog under 
Communication > Open user communication. The graphic representation of the 
block calls is shown in Fig. 17.12. 


You have to establish a connection to the communication layer of the operating sys- 
tem with TCON before transferring the data. The address of the communication 
partner is located in a data area that has the structure of the data type TADD_PAR. 
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TUSEND Send data with UDP 
TUSEND sends data with the UDP protocol. 


The assignment of the ID parameter designates the connection between the user 
program and the communication layer of the operating system. The value must 
agree with the id tag in the connection data. Specify the send mailbox with the 
pointer at the DATA parameter. 


The information on the communication partner is located in a data area to which 
the pointer at the ADDR parameter points. With each new send job, the address and 
thus the partner can be changed without having to redefine the communication 
access point with TCON. 


In the initial state, the REQ, BUSY, DONE, and ERROR parameters have signal state 
“0”. Start data transfer with a rising edge at the REQ parameter. On the initial call 
with “1”, the data is fetched from the area specified by the DATA parameter. The 
number of bytes specified at the LEN parameter is sent (1 to max. 1460). 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, DONE = “1”, and ERROR = “0”. If the job contains errors, then BUSY = 
“0”, DONE = “0”, and ERROR = “1”. The error is then specified at the STATUS 
parameter. BUSY, DONE, and ERROR are reset to “0” if REQ is returned to “O”. 


The data in the send area can then be modified again when either DONE or ERROR 
has signal state “1”. 


TURCV Receive data with UDP 


TURCV receives data with the UDP protocol. 


The assignment of the ID parameter designates the connection between the user 
program and the communication layer of the operating system. The value must 
agree with the id tag in the connection data. Specify the receive mailbox with the 
pointer at the DATA parameter. 


The information on the communication partner is located in a data area to which 
the pointer at the ADDR parameter points. 


The number of bytes to be received is set at the LEN parameter (1 to max. 1460). 
After a data block has been received, the number of bytes received is made available 
at the RCVD_LEN parameter and NDR is set to signal state “1”. 


Data is only received if the EN_R parameter has signal state “1”. 


While the job is running, BUSY = “1”. The job has been successfully completed if 
BUSY = “0”, NDR = “1”, and ERROR = “0”. If the job contains errors, BUSY = “0”, 
NDR = “0”, and ERROR = “1”. The error is then specified at the STATUS parameter. 
BUSY, NDR, and ERROR are reset to “0” if EN_R is returned to “0”. 


The data in the receive area is consistent if NDR has signal state “1”. 
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UDP (User Data Protocol) 


Establishment of a connection is not carried out with UDP. The communication 
partner is specified at the ADDR parameter of the send block (IP address and port 
number). The receive block then supplies the IP address and the port number of the 
sender at the ADDR parameter. 


The data type TADD PAR contains the structure of the address information. 
The pointer at ADDR points to a data area with this structure. 


With UDP, information on the length and end of a message frame is transferred. 
If LEN at the receive block is larger, the sent data is copied to the receive mailbox, 
NDR is set to “1” and the number of received bytes is written in RCVD_LEN. If LEN is 
smaller, an error message is issued: ERROR = “1”, STATUS = W#16#8088. 


TADDR_PAR Structure of the address information with UDP 


The data type TADDR_PAR (UDT 66) contains the structure of the remote partner's 
address information when using the UDP protocol. With this data structure you 
configure a data area in a data block which contains the addresses of the receiver 
station and parameterize this data area at the ADDR parameter of the send block 
TUSEND. At the receive block TURCV you parameterize a data area with this struc- 
ture at the ADDR parameter which accommodates the addresses of the transmitting 
station (Table 17.3). 


Table 17.3 Structure of data type TADDR_PAR 


Byte Parameter Data type Description 


0 to3 rem_ip_addr ARRAY [1..4] OF BYTE IP address of remote partner 


4and5 | rem_port_nr ARRAY [1..2] OF BYTE Port no. of remote partner 


6and7 | spare ARRAY [1..2] OF BYTE B#16#00 


17.5 Point-to-point communication 


17.5.1 Basics 


Communication over a point-to-point (PtP) connection can occur in two ways: ho- 
mogeneous and inhomogeneous communication. 


In the homogeneous PtP communication, the data exchange takes place via an S7 
connection. The CP module takes over the function of a router; the CPU is the ter- 
minal device. In the user program, all S7 communication functions that both part- 
ners are capable of can be used. 


In the inhomogeneous PtP communication, the data exchange between the CP 
modules takes place via a PtP connection. The CP module takes over the transfer of 
the data of the internal S7 connection between the CPU and the CP module into the 
configured protocol, e.g. RK 512 (Fig. 17.13). 
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PtP communication 


PLC station PLC station 
User program in the CPU CP 441 User program in the CPU CP 441 
Homogeneous PtP communication Homogeneous PtP communication 
Communication Communication 
Data function Re Data function Re 
= = sourc- = = sourc- 
<—P> TJ Ee GP es —> = gE ——> es 
Data transmission Data transmission 
possible with any available possible with any available 
communication function communication function 
PtP subnet — S7 connection a 
PLC station PLC station 
User program in the CPU CP 441 User program in the CPU CP 441 
Inhomogeneous PtP communication Operating Inhomogeneous PtP communication Operating 
system system 
BSEND BSEND 
Data Bee Re- Data BHO Re- 
= = sourc- = = sourc- 
<——>> Zi a — es <—P =i _ <> es 
Send data with BSEND Send data with BSEND 
(one and two-way) (one and two-way) 
Receive data with BRCV Receive data with BRCV 
Additionally with RK 512: 
PUT 
Data SED , 
= = No user program required 
<_ | - <> 
PtP subnet ——— PtP connection | 


Fig. 17.13 Principle of PtP communication 


The communication functions for an S7 connection are described in Chapter 17.3 
“S7 Communication” on page 682. For the inhomogeneous PtP communication, 
the communication functions BSEND, BRCV, STATUS, and PRINT are used; for the 
RK 512 protocol, PUT and GET are additionally used. 


The CP 441 module has one or two slots for an interface module with the interface 
types TTY, RS232C, or RS422/485. Depending on the interface type, the protocols for 
the ASCII driver, the procedure 3964(R), the RK 512 computer link, the printer driv- 
er, and the Modbus Master and Modbus Slave are supported. 
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17.5.2 Data transmission with the 3964 (R) procedure 


Data transmission with the CP 441 module and the 3964(R) procedure can be exe- 
cuted bilaterally or unilaterally. 


Sending data to a CP 441 module with fixed destination (bilateral) 


In the user program of the CPU sending the data, the communication function 
BSEND is called; in the user program of the receiving CPU, the communication func- 
tion BRCV is called. In the sending CPU, the BSEND function is called once for each 
connection with different allocation of the parameter R_ID. In the receiving CPU, 
the function BRCV is called once per interface, where the parameter R_ID is as- 
signed DW#16#0000_0000. 


You specify the data source at the SD_1 parameter (BSEND). When you address a da- 
ta area with an ANY pointer, the length specified in the ANY pointer is irrelevant: 
The number of bytes transferred is specified in the LEN parameter. The transferred 
length is limited to 4096 bytes. 


You specify the data destination at the RD_1 parameter (BRCV). When you address 
a data area with an ANY pointer, the length in the ANY pointer specifies the maxi- 
mum length of the data block to be received. 


Sending data to a CP 441 module with fixed destination (unilateral) 


In the user program of the CPU sending the data, the communication function 
BSEND is called; in the user program of the receiving CPU, no communication func- 
tion is necessary in the user program. However, the CP module then cannot signal 
that new data has been received. Data transmission also takes place in STOP mode 
with the data consistency of the receiving CPU (16 bytes for CPU 412/413, 32 bytes 
for CPU 414/416/417). 


You specify the data source at the SD_1 parameter (BSEND). When you address a da- 
ta area with an ANY pointer, the length specified in the ANY pointer is irrelevant: 
The number of bytes transferred is specified in the LEN parameter. The transferred 
length is limited to 4096 bytes. 


The receive mailbox (the data area) in the receiving CPU is configured using the pa- 
rameterization interface of the CP 441 “Configuration Package for Point to Point 
Communication”. The data block must be larger than the maximum amount of data 
transferred by two bytes, because the length of the received data is displayed in the 
first two bytes. 


17.5.3 Data transmission with the RK 512 protocol 


In conjunction with a CP 441 module, the RK 512 protocol allows sending data with 
fixed and variable target indication as well as data retrieval. Moreover, a distinction 
is made as to whether the connection is unilateral or bilateral, and whether the con- 
nection partner is a CP 441 communication module or another device such as a 
SIMATIC S5 device. 
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The bilateral connection requires the communication function BSEND to transmit 
data and the communication function BRCV to receive data. For the two-way con- 
nection, you can also see when the data has been completely received by evaluating 
the parameter NDR at BRCV. With parameter EN_R you can prevent overwriting of 
data that has not yet been processed. 


The unilateral connection requires no communication function in the user pro- 
gram of the receiving CPU. However, you can then not recognize when a data trans- 
fer is taking place in the receiving CPU and also not prevent overwriting of data that 
has not yet been processed. In the unilateral connection, data transmission takes 
place even in STOP mode of the partner CPU. The length of the consistently trans- 
ferred data depends on the partner CPU (at BSEND) or the CPU with the smaller 
length (for PUT and GET). Data consistency is 16 bytes for the CPU 412/413 and 32 
bytes for the CPU 414/416/417. 


Sending data to a CP 441 module with fixed destination (bilateral) 


In the sending CPU, you call the function BSEND for each connection. You specify 
the data source at the SD_1 parameter. When you address a data area with an ANY 
pointer, the length specified in the ANY pointer is irrelevant: The number of bytes 
transferred is specified in the LEN parameter. The transferrable length is limited to 
4096 bytes. At parameter R_ID you enter a value between 0 and 255. The value is im- 
ported once during CPU startup and cannot subsequently be changed. 


In the receiving CPU, you call the BRCV function for each connection. At parameter 
R_ID, enter the same value that you specified at the BSEND function at parameter 
R_ID. You specify the data destination at parameter RD_1. When you address a data 
area with an ANY pointer, the length in the ANY pointer specifies the maximum 
length of the data block to be received. 


Communication flag byte and communication flag bit are not evaluated. 


Sending data to a CP 441 module with fixed destination (unilateral) 


In the sending CPU, you call the function BSEND for each connection. You specify 
the data source at the SD_1 parameter. When you address a data area with an ANY 
pointer, the length specified in the ANY pointer is irrelevant: The number of bytes 
transferred is specified in the LEN parameter. Depending on the partner CPU, the 
transferable length is limited to 450 bytes. 


At parameter R_ID, specify the destination area in the receiving CPU. The value is 
imported once during CPU startup and cannot subsequently be changed. The des- 
tination area - this is always a data block - is in a doubleword with the following 
structure: 


Byte 1: B#16#01 = data block DB 
Byte 2: B#16#00 (any) 
Byte 3: B#00 to B#FF = specification of the data amount in words 


Byte 4: B#01 to B#FF = specification of the data block number 
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Sending data to an external device with a fixed destination indication 


In the sending CPU, you call the function BSEND for each connection. You specify 
the data source at the SD_1 parameter. When you address a data area with an ANY 
pointer, the length specified in the ANY pointer is irrelevant: The number of bytes 
transferred is specified in the LEN parameter. The transferrable length is limited to 
4096 bytes. 


At parameter R_ID, specify the destination area in the receiving CPU. The value is 
imported once during CPU startup and cannot subsequently be changed. The des- 
tination area - for a SIMATIC S5 device, for example, this is a data block - is in a dou- 
bleword with the following structure: 


Byte 1, bits 0 to 3: 16#0 = extended data block Dx, 
16#1 = data block DB 


Byte 1, bits 4 to 7: 16#0 to 16#7 = communication flag bit, 
16#F = no interprocessor communication flag 


Byte 2: B#16#01 to B#16#E9 = communication flag byte (1 - 233), 
B#16#FF = no interprocessor communication flag 

Byte 3: B#16#00 to B#16#FF = specification of the data amount in words 

Byte 4: B#16#03 to B#16#FF = specification of the data block number 


Sending data to a CP 441 module with dynamic destination indication 


In the sending CPU, you call the function PUT. You specify the data source at the SD 
parameter. When you address a data area with an ANY pointer, for the data (D), 
SIMATIC timers (T), and SIMATIC counters operand areas, the length specification 
must only be an even number (maximum 450 bytes). For the inputs (I), outputs (Q), 
and bit memories (M) operand areas, the maximum amount of data is 255 bytes. 
You specify the destination area at the ADDR parameter. The size of the destination 
area must be the same as the size of the source area. 


Sending data with the PUT function does not require a communication function in 
the user program of the receiving CPU. However, you can then not recognize when 
a data transfer is taking place in the receiving CPU and also not prevent overwriting 
of data that has not yet been processed. 


Retrieving data from a CP 441 module with dynamic destination indication 


In the retrieving CPU, you call the function GET. At the ADDR parameter, you specify 
the data source (in the partner CPU). When you address a data area with an ANY 
pointer, for the data (D), SIMATIC timers (T), and SIMATIC counters operand areas, 
the length specification must only be an even number (maximum 450 bytes). For 
the inputs (I), outputs (Q), and bit memories (M) operand areas, the maximum 
amount of data is 255 bytes. You specify the destination area at the SD parameter. 
The size of the destination area must be the same as the size of the source area. 


Retrieving data with the GET function does not require a communication function 
in the user program of the sending CPU. However, you can then not recognize when 
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a data transfer is taking place in the sending CPU and also not prevent retrieval of 
data that has not yet been processed. 


17.5.4 Data transmission with the ASCII driver 


For data transmission with the ASCII driver, you can use the same functions as for 
data transmission with the procedure 3964(R) (see Chapter 17.5.2 “Data transmis- 
sion with the 3964 (R) procedure” on page 702). In addition, when using the RS232C 
interface module, you can read and control the RS232C secondary signals. 


Read and control accompanying signals 


The following blocks are available for reading and controlling the RS232C second- 
ary signals at an interface of the CP 441 communication module: 


> V24 STAT 441 Read secondary signals (FB 5) 
> V24 SET 441 Control secondary signals (FB 6) 


The blocks are located in the program elements catalog under Communication > 
Communications processor > PtP connection: CP 441. The graphic representation of 
the block calls is shown in Fig. 17.14. 


Standard blocks for reading and controlling of secondary signals 


FB5 FB6 
Read secondary signals Control secondary signals 
Instance data Instance data 
V24 STAT 441 V24 SET 441 The blocks read and control 
= = —— the secondary signals at the 
— REQ NDR—— — REQ DONE —_ RS232C interface module 
ina CP 441 module. 
—D ERROR ——_ —— ID ERROR —— . ; 
You specify the interface by 
STATUS —— — —— RTS STATUS —— entering the “local ID” of a 
reo —_ — eit connection running via the 
DSR IN—— interface at the parameter ID. 
RTS_OUT — 
cTs_IN — 
DCD_IN — 
RIN — 


Fig. 17.14 Reading and controlling secondary signals with the CP 441 module 


V24_STAT_ 441 Read secondary signals 


V24_STAT_441 reads the RS232C secondary signals from an RS232C interface of 
the CP 441 module. A rising signal edge at the REQ parameter activates the trans- 
fer of the signals. With signal state “1” the NDR parameter indicates the conclusion 
of the job. The ERROR parameter indicates an error that is specified in the STATUS 
parameter with signal state “1”. A positive voltage at the interface signals DSR, CTS, 
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DCD, and RI is indicated as signal state “1” at the block parameters DSR_IN, CTS_IN, 
DCD_IN, and RI_IN. 


V24_SET_ 441 Control secondary signals 


V24 SET 441 controls the RS232C secondary signals at an RS232C interface of the 
CP 441 module. A rising signal edge at the REQ parameter activates the transfer of 
the signals RTS and DTR. With signal state “1” the DONE parameter indicates the 
conclusion of the job. The ERROR parameter indicates an error that is specified in 
the STATUS parameter with signal state “1”. 
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18 Appendix 


18.1 Working with source files 


Blocks with the programming languages STL or SCL can be programmed as a text 
file outside the TIA Portal. Any text editor which generates ASCII-coded text can be 
used for this. Blocks which can be edited further with STEP 7 are generated from 
these text files - referred to as “source files” or “program sources” — by importing 
into the TIA Portal and subsequent compilation. Blocks programmed with STL or 
SCL in the TIA Portal can also be saved as text files. 


18.1.1 General procedure 


A source file can be generated in two different ways: You write the source file com- 
pletely using a text editor, or you take a block as template and generate a source file 
by exporting the block. Following editing with the text editor, you import the exter- 
nal source file into the TIA Portal and generate the blocks contained in the source 
file by compiling. You can then edit these further using the program editor of 
STEP 7. 


Generating a source file by exporting 


In the project tree, select the block(s) from which you wish to generate a source file 
in the Program blocks folder and select the Copy as text command from the shortcut 
menu. The program editor writes the source text into the Windows clipboard. 


Start the desired text editor and paste in the contents of the clipboard. Save an STL 
source file with the file extension .stl and an SCL source file with the file 
extension .scl. Files with these extensions can be imported as external source files 
into the TIA Portal. 


Generating a source file with a text editor 


In order to program a block, you must use keywords in a specific sequence in the 
source file. The program of each block consists of the block header with specifica- 
tion of the block type and properties. With logic blocks, this is followed by the dec- 
laration of the interface and the actual program. With data blocks and PLC data 
types you subsequently specify the data operands or types. 


If the source file contains blocks which are called in the source file or if data oper- 
ands are accessed, you should observe a specific sequence in the source file. The 
blocks or data operands should be located before the position of use in the source 
file. You can also call blocks in the source file which are present in the Program 
blocks folder or use system blocks from the program elements catalog. 
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A source file can contain several blocks and these can be logic or data blocks as well 
as PLC data types. You export and import PLC tags separate from the source file (see 
Chapter 6.2.3 “Exporting and importing a PLC tag table” on page 256). 


When working with source files, you must handle blocks generated using STL sep- 
arate from those generated using SCL. A source file can contain either only STL 
blocks or only SCL blocks. In both cases, the source file can contain data blocks and 
PLC data types. 


You save a source file with STL program with the file extension .stl and a source file 
with SCL program with the file extension .scl. If you only program data blocks or 
PLC data types, the file extension is irrelevant. 


The following chapters describe how to program blocks in a source file. 


Importing an external source file 


To import an external source file, open the External source files folder in the project 
tree and double-click on Add new external file. In the dialog window, select the type 
of source (STL sources or SCL sources), navigate to the storage location, select the 
source file, and import it by clicking on the Open button. 


The source file is saved in the External source files folder. 


Editing an external source file in the TIA Portal 


As preparation for editing an external source file in the TIA Portal, you must link 
the file extension .stl or .scl to a text editor. To do this, open the Windows Explorer, 
navigate to the source file, and select the Properties dialog from the shortcut menu 
of the source file. In the General tab, click on Changein the File type area. Under 
Open with, select the editor which you wish to link to the file extension .stl or .scl. 


You can then edit the source file using the linked editor by double-clicking on it in 
the External sources folder. 


Generating the blocks of an external source file 


To transfer the blocks from the source file to the Program blocks folder, select a 
source file in the External source files folder and then the Generate blocks command 
from the shortcut menu. Acknowledge the message which may appear informing 
that existing blocks will be overwritten. The generated blocks are imported into the 
Program blocks folder. The result of the generation is shown by STEP 7 in the inspec- 
tor window in the Info > Compile tab. Note that these messages refer to the source 
file. 


It is recommendable to compile the blocks imported from the source file prior to 
further processing in the TIA Portal. 


18.1.2 Programming a logic block in the source file 


Table 18.1 shows which keywords you require for block programming and the se- 
quence in which the keywords are used. 
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Table 18.1 Keywords for logic blocks 


Section Keyword Meaning 
Block type ORGANIZATION_ BLOCK “OB_name” Start of an organization block 
FUNCTION_BLOCK “FB_name” Start of a function block 
FUNCTION “FC_name” : Data type Start of a function 
Header TITLE = block title Block title in the block properties 
IIBlock comment Block comment in the block properties 
CODE_VERSION1 Only with FB (“not capable of multi-instance”), 
only with STL 
KNOW_HOW_PROTECT Know-how protection (cannot be canceled) 
NAME : Block name Block property: Block name 
FAMILY : Block family Block property: Block family 
AUTHOR : Created by Block property: Created by 
VERSION : Version Block property: Block version 
Declaration VAR_INPUT Input parameter (not with OB) 
name : Data type := Default setting; *) 
END_VAR 
VAR_OUTPUT Output parameter (not with OB) 
name : Data type := Default setting; *) 
END_VAR 
VAR_IN_OUT In/out parameter (not with OB) 
name : Data type := Default setting; *) 
END_VAR 
VAR Static local data (only with FB) 
name : Data type := Default setting; *) 
END_VAR 
VAR_TEMP Temporary local data 
name : Data type := Default setting; *) 
END_VAR 
Program BEGIN Start of block program, 
can be omitted with SCL 
NETWORK Network start, only with STL 
TITLE = Network title Network title, only with STL 
//Network comment Network comment; line comment with SCL 
Program statement; Termination of each statement with semicolon 
I/Line comment Line comment up to end of line, also programmable 
following statements 
(* Block comment *) Block comment, can extend over several lines, 
only with SCL 
NETWORK Start of next network, only with STL 
. etc. 
Block end END_ORGANIZATION_ BLOCK End of an organization block 


END_FUNCTION_BLOCK 
END_FUNCTION 


End of a function block 
End of a function 


*) Overlaying of data types with the keyword AT is additionally possible with SCL (see text) 
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Block header and block properties 


A logic block commences with the keyword for the block type and with the speci- 
fication of the block name. With symbolic addressing (e.g. FUNCTION _ BLOCK 
“FB name”), the first vacant number of the block type is assigned when import- 
ing for absolute addressing. When specifying an absolute address (e.g. FUNC- 
TION_BLOCK %FB102), the operand with the number is imported as the symbolic 
address. 


With symbolic addressing, an organization block should have the standard name. 
The correct block number is then assigned to it when importing from the external 
source. If the organization block has any name, it is assigned 0 (zero) as the num- 
ber. The envisaged block number must then be manually assigned to this OB 0, for 
example using the Properties command in the shortcut menu of the organization 
block. The standard names of the organization blocks are listed in Table 5.4 
“Startup program” on page 171. 


In the case of functions, you specify the data type of the function value following 
the addressing; example: FUNCTION “FC_name’” : INT. If the function does not have 
a function value, the data type is called VOID. 


The data for the block properties is optional. You simply omit the surplus data to- 
gether with the keywords. 


The keyword KNOW_HOW_PROTECT protects the block from unwanted access. You 
can no longer cancel this protection, in contrast to block protection with password 
in the TIA Portal. 


The keyword CODE_VERSION1 is permissible for function blocks with STL program. 
Following importing into STEP 7, the block attribute Multiple instance capability can 
be enabled or disabled for these function blocks. 


Block interface 


The block interface contains the definition of the block parameters and block-local 
tags. You cannot program every declaration section in every block (see Table 18.1). 
If you do not use a declaration section, omit it including the keywords. 


The declaration of a tag consists of the name, the data type, possibly a default set- 
ting, and an optional tag comment. Example: 


Quantity : INT := +500; //Units per batch 


Not all tags can have default values, e.g. default values are not possible for the tem- 
porary local data. Chapter 5.2.5 “Block interface” on page 162 describes the data 
types permissible for block parameters. 


The sequence of individual declaration sections is defined as shown in the table. 
The sequence within a declaration section is optional. If you combine tags with data 
type BOOL and also combine byte-wide tags with data types BYTE and CHAR, you 
can minimize the memory requirements. 


The programming language SCL permits the overlaying of data types with the key- 
word AT in the declaration section of logic blocks. You program the overlaying di- 
rectly after the declaration of the tags to be overlaid. The schema is as follows: 
var_new AT var_old : new_data type. Example: 
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VAR_INPUT 

Date 7-DEF 

Byte array AT date : ARRAY [1..8] OF BYTE; 
END_VAR 


You can now address the total tag in the program of the block using #Date or indi- 
vidual components such as the day using Byte_array[3]. 


Overlaying a data type is described in Chapter 4.4 “Elementary data types” in sec- 
tion “Overlaying tags (data type views with SCL)” on page 120. 


Program section 


The program section of a logic block starts with the keyword BEGIN and ends with 
the keyword for the block end. 


No distinction is made between upper and lower case when compiling, except for 
jump labels. Refer to Chapter 9.1.2 “Structure of an STL statement” on page 349 for 
the syntax of an STL statement and to Chapter 10.1.2 “SCL statements and 
operators” on page 398 for that of an SCL statement. You can enter one or more 
spaces or tabulators between operation and operand. To achieve a clearer layout of 
the source text, you can enter any spaces and/or tabulators between the words. 


You must conclude every statement by a semicolon. Following the semicolon you 
can specify a statement comment, separated by two slashes; this extends up to the 
end of the line. You can also program several statements per line, each separated by 
a semicolon. 


Aline comment commences with two slashes at the start of the line. A line comment 
can have up to 160 characters, but no tabulators or non-printable characters. 


A block comment with SCL is started by a round left parenthesis and asterisk and 
finished by an asterisk and round right parenthesis. A block comment can extend 
over several lines. 


You can also program networks to structure the block program better in STL. 
Networks commence with the keyword NETWORK. You can assign a title to every 
network using the keyword TITLE, which is present in the next line. The line com- 
ments which directly follow the network title are the network comment. No net- 
works are possible with SCL. 


If the source file contains blocks which are called in the source file or if data oper- 
ands are accessed, you should observe a specific sequence in the source file. The 
blocks or data operands should be located before the position of use in the source 
file. 


When calling a block, you enter the block parameters in round parentheses, each 
separated by a comma. Make sure that the transferred block parameters are listed 
in the same order as they have been declared in the called block. 


Fig. 18.1 shows an example of an STL source file for a function block with the asso- 
ciated instance data block. 


Fig. 18.2 shows an example of an SCL source file for a function block with the asso- 
ciated instance data block. 
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FUNCTION BLOCK FIFO STL 
TITLE = Intermediate memory for 4 values 
//Example of a function block in STL 


ANUMIEISKOURS «= BYSuate(Se 
FAMILY : Book_400 
NAME : Memory 


VERSION : 01.00 


VAR_INPUT 
Transfer : BOOL := FALSE; //Transfer on positive edge 
Input_value : REAL := 0.0; //In data format REAL 
END VAR 
VAR_OUTPUT 
Oibngorbhe. Selle: B irumy B= (0) .(0P //In data format REAL 
END VAR 
VAR 
Valuel : REAL := 0.0; //First saved REAL value 
Value2 : REAL := 0.0; //Second value 
Value3 : REAL := 0.0; //Third value 
Value4 : REAL := 0.0; //Fourth value 
Edge_memory bit : BOOL := FALSE; //Edge memory bit for the transfer 
END VAR 
BEGIN 
NETWORK 


TELM, == eelexspreeial ac@ne iwiceholisueiSie xelialol (oybliejoublie 
//Transfer and output take place with a positive edge at Transfer 


A Wbiereunuss15Se'2 /f/If Transfer changes ta "i", 

FP Edge memory bit; //the RLO = "1" following FP 

JCN end; //Jump if no positive edge is present 
//Transfer of values starting with the last value 

L Value4; 

© Output_value; //Output of last value 

L Value3; 

ae Value4; 

L Value2; 

iy Value3; 

L Valuel; 

ae Value2; 

L Input_value; //Transfer of input value 

ap Valuel; 
iaele IEE 


END_FUNCTION_ BLOCK 


DATA BLOCK DB FIFO STL 
TITLE= Instance Gate block tom "FT FOUSTL™ 
//Example of an instance data block 


ANUMUSIONR. —-B IBYSaete(Se 

FAMILY : Book_400 

NAME : FIFO Dat 

VERSION : 01.00 

EIEIO) ‘Sy7tih //Instance for the FB Kee O Gory 

BEGIN 
Valuel := 1.0; //Individual default setting 
Value2 := 1.0; //of selected values 


END_DATA BLOCK 


Fig. 18.1 Example of an STL source file 
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FUNCTION BLOCK FIFO SCL 
TITLE = Intermediate memory for 4 values 
//Example of a function block with static local data in SCL 


ANUMASLONR, 31S (Ssele(Sie 
FAMILY : Book _400 
NAME : Memory 
VERSION : 01.00 


VAR_INPUT 
Transfer : BOOL := FALSE; //Transfer with positive edge 
Wojetele wellline 2 inal B= OOP //In data format REAL 
END_VAR 
VAR_OUTPUT 
Output_value : REAL := 0.0; //In data format REAL 
END VAR 
VAR 
Valuel : REAL := 0.0; //First saved REAL value 
Value2 : REAL := 0.0; //Second value 
Value3 : REAL := 0.0; //Third value 
Value4 : REAL := 0.0; //Fourth value 
Edge_memory bit : BOOL := FALSE; //Edge memory bit for the transfer 
END_VAR 
BEGIN 


//Transfer and output take place with a positive edge at Transfer 
IF Transfer = TRUE AND Edge memory bit = FALSE 


THEN Output velue t= Velued; 
//Transfer of values starting with the last value 
Value4 := Value3; 
Value3 := Value2; 
Value2 := Valuel; 
VeluGias= nieuievel ues 
END_IF; 
Edge memory bit := Transfer; //Update edge memory bit 


END FUNCTION BLOCK 


DATA BLOCK DB_FIFO_SCL 
Titi] iiglence ate flock i¢r Vier ocl 
//Example of an instance data block 


AUMHORSS-ayp egies 
FAMILY : Book_400 
NAME  PLPOU@aL 
VERSION : 01.00 


FIFO_SCL LP WREDNCS HOHE Wie: wie} Mina _ Seu! 
BEGIN 
Valuel := 1.0; //Individual default setting 
Value2 := 1.0; //of selected values 


END_DATA BLOCK 


Fig. 18.2 Example of an SCL source file 
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18.1.3. Programming a data block in the source file 


Table 18.2 shows which keywords you require for block programming and the se- 
quence in which the keywords are used. 


Table 18.2 Keywords for data blocks 


Section Keyword Meaning 
Block type DATA_BLOCK “DB_name” Start of a data block 
Header TITLE = block title Block title 
I[Block comment Block comment 
KNOW_HOW_PROTECT Know-how protection (cannot be canceled) 
UNLINKED Block attribute: not executable 
READ_ONLY Block attribute: read-only 
NON_RETAIN Block attribute: non-retentive 
NAME : Block name Block property: Block name 
FAMILY : Block family Block property: Block family 
AUTHOR : Created by Block property: Created by 
VERSION : Version Block property: Block version 
Declaration STRUCT For a global data block 
name : Data type := Default setting; 
END_STRUCT 
Data type_name Alternatively for a type data block 
FB_name Alternatively for an instance data block 
Initialization BEGIN 
name := Default setting; Assignment with individual start values 
Block end END_DATA_BLOCK End of a data block 


Block header and block properties 


A data block commences with the keyword DATA_BLOCK and with specification of 
the block name. With symbolic addressing (e.g. DATA_BLOCK “DB_ name’), the first 
vacant data block number is assigned when importing for absolute addressing. 
When specifying an absolute address (e.g. DATA_BLOCK %DB102), the operand with 
the number is imported as the symbolic address. 


The data for the block properties is optional. You simply omit the surplus data to- 
gether with the keywords. 


The keyword KNOW_HOW_PROTECT protects the block from unwanted access. You 
can no longer cancel this protection, in contrast to block protection with password 
in the TIA Portal. 


Block interface 


The block interface contains the declaration of the data operands. With a global da- 
ta block, you program the data operand here, with a type data block, you specify the 
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assigned PLC data type, and with an instance data block, you assign the associated 
function block. 


The declaration of a tag in a global data block consists of the name, the data type, 
possibly a default setting, and an optional tag comment. Example: 


Quantity : INT := +500; //Units per batch 


The tag order can be random. If you combine tags with data type BOOL and also 
combine byte-wide tags with data types BYTE and CHAR, you can minimize the 
memory requirements (see also Chapter 18.5.1 “Storage in global data blocks” on 
page 731). 


The declaration in a type data block consists only of the specification of the as- 
signed PLC data type. 


The declaration in an instance data block consists only of the specification of the 
assigned function block. 


Default setting with start values 


The initialization part starts with BEGIN and ends with END_DATA BLOCK. You 
must specify these keywords even if you do not assign default values to the tags in 
the initialization part. 


By assigning default values to the start values, it is possible to assign individual val- 
ues to each application (each instance) in the case of type and instance data blocks. 


If you do not specify a start value for a data operand, the value from the block inter- 
face is used: The default value is retained for a global data block and the default val- 
ue in the PLC data type or in the function block then applies to a type or instance 
data block. 


18.1.4 Programming a PLC data type in the source file 


Table 18.3 shows which keywords you require for data type programming and the 
sequence in which the keywords are used. 


Table 18.3 Keywords for PLC data types 


Section Keyword Meaning 

Block type TYPE “Type_name” Start of a PLC data type 

Header TITLE = Data type title Data type title 
[[Data type comment Data type comment 

Declaration STRUCT Declaration of data type components 
name : Data type := Default setting; 
END_STRUCT 

Block end END_TYPE End of the PLC data type 
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Block header 


A PLC data type (UDT, user data type) starts with the keyword TYPE and with the da- 
ta type name. With symbolic addressing (e.g. TYPE “Type_name”), the first vacant 
data type number is assigned when importing for absolute addressing. When spec- 
ifying an absolute address (e.g. TYPE %UDT102), the operand with the number is 
imported as the symbolic address. 


The data for the header is optional. You simply omit the surplus data together with 
the keywords. 


Declaration of data type 


The declaration part contains the definition of the data type components. The struc- 
ture of a PLC data type corresponds to that of a data structure STRUCT. 


The declaration of a component consists of the name, the data type, possibly a de- 
fault setting, and an optional comment. Example: 


Quantity : INT := +500; //Units per batch 


18.2 Migrating projects 


Automation projects which have been created using STEP 7 Version 5.4 SP5 or later 
can be migrated into the TIA Portal. The target project resulting from the original 
project can then be edited further in the TIA Portal using STEP 7. 


The migration tool is delivered together with STEP 7 Professional V11 or can be 
downloaded from the Internet. To install the migration tool, start the “Migra- 
tion_Tool_TIA_V11.exe” file and follow the instructions. 


Preparations and sequence of project migration 


A prerequisite for migration is the installation of all applications with which the 
original project was created. This also includes the option packages and the Hard- 
ware Support Packages (HSP). If these applications are installed together with the 
TIA Portal on the programming device, you can migrate the original project direct- 
ly. Otherwise you install the migration tool on the programming device which con- 
tains the original project with the required applications, create an intermediate 
project with the file extension .am11 from the original project, transfer this inter- 
mediate project to a programming device with the TIA Portal, and then migrate the 
project. 


Areport with the result of the migration is displayed in the inspector window at the 
end of migration. Here you can find references to project components which were 
not migrated or were modified by the migration. Not all components of the original 
project can be migrated unchanged. For example, a hardware configuration whose 
components do not support the TIA Portal cannot be imported into the target proj- 
ect. You can also exclude the hardware configuration from the migration. In this 
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case only the software is migrated into the target project and a non-specified device 
is generated in the target project for each device present in the original project. 


Associated with a successful migration is that you systematically process the infor- 
mation in the migration report. 


Prerequisites in the original project 


The original project must not be a multi-project and must not be provided with ac- 
cess protection. It must be possible to compile the original project and - if present 
— the source files without error. The block folder must contain all called blocks and 
must not contain any uncalled blocks. The message number assignment must be 
set to CPU-wide. 


Removing unsupported hardware components 


If the original project contains hardware components that are no longer available 
for the suitable application or for which the required option package is missing in 
STEP 7 V11, delete the non-supported configuration manually from the project: To 
open the original project, use an installation of STEP 7 V5.4 or V5.5 containing only 
option packages and modules available in STEP 7 V11 and save the project with 
the option With reorganization. Any unsupported configurations are removed 
from the project. 


If modules are used in the original project that are only available in STEP 7 V11 in 
a newer version or with a newer firmware version, replace the older module with 
migratable modules in the hardware configuration: With the SIMATIC station se- 
lected in the SIMATIC Manager, double-click on the Hardware object, select the 
module in the hardware configuration, and select Exchange Object from the short- 
cut menu. 


Migrating a project 


Select the Project > Migrate project command in the main menu. Enter either the in- 
termediate project with the file extension .am11 or the original project in the 
Source path box. Insert the name with the storage location for the target project, 
and also the author and a comment if applicable. Clicking on the Migrate button 
starts the migration. 


The report generated during migration is displayed in the inspector window direct- 
ly following the end of migration. You can also obtain this report if you select the 
project in the project tree, followed by the Properties command in the shortcut 
menu, and then click on the Report file link in the Project progress group. 


Special characteristics for the migration of program blocks 


Functions and statements are converted into the representation which is standard 
for the TIA Portal and may therefore deviate from the previous representation. 
System blocks and standard blocks from a standard library are converted into state- 
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ments which can be found in the program elements catalog under Extended instruc- 
tions. 


In the TIA Portal, an operand addressed in absolute mode is assigned a symbolic ad- 
dress (a name). Together with the name, the operand is also assigned a data type. 
This results in a type conflict if the operand addressed in absolute mode is used to- 
gether with functions which require different data types, for example if a memory 
word addressed in absolute mode is used in both an integer addition and in a shift 
function. 


The name of an I/O operand is not imported. Instead of this, a “:P” is appended to 
the name of the input or output operand. Undefined input and output operands are 
assigned a (new) name in the process. 


You migrate programs in libraries in that you copy the programs into a project and 
migrate the latter. 


Stricter rules for checking in accordance with IEC directives in the TIA Portal may 
lead to errors during migration. For example, a check is now carried out for func- 
tions (FC) that own input parameters may no longer be written and own output pa- 
rameters may no longer be read. 


With jump labels, a distinction is no longer made between upper and lower case 
during the check for uniqueness; if applicable, jump labels are assigned new 
names. 


A start value defined by the user in global data blocks is replaced by a default value. 
A start value defined in a type data block (specified by the user-defined data type 
UDT) is retained. 


Migration of blocks with know-how protection 


Program sources are not migrated. This has effects on the know-how protection: 
A block with know-how protection remains protected even following migration. 
However, the know-how protection can no longer be canceled since the program 
source is no longer available. Therefore remove the know-how protection prior to 
migration and protect the block following the migration using the Edit > Know-how 
protection command. 


If the program sources of SCL blocks are missing in the original project, the blocks 
are migrated into blocks with know-how protection. If the program sources are 
present, the blocks are migrated into non-protected blocks. If applicable, you must 
then protect the associated blocks again using the Edit > Know-how protection com- 
mand. 


Migration of LAD and FBD blocks 


Blocks with jump functions created in LAD or FBD are represented in STL following 
the migration, even though the programming language remains set to LAD or FBD. 
To correct the representation, you set the programming language in the block to 
STL and subsequently back to LAD or FBD again. 
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Migration of SCL blocks 


A prerequisite for the migration of SCL blocks is that an S7-SCL V5.3 SP5 (or later) 
option package is installed. 


The following are no longer present with SCL blocks in the TIA Portal: Jump labels 
in the declaration part (the jump labels are retained in the program), symbolic con- 
stants in the declaration part (these are replaced by global user-defined constants, 
also with a different name if there is a name conflict), symbolic constants as limits 
for the ARRAY declaration (these are replaced by fixed values), nested ARRAY tags 
(these are replaced by multi-dimensional arrays), the DIV operator (this is replaced 
by the slash “/”), and the EXPD function (this is replaced by the notation “10**”). 


The program in SCL blocks is changed as follows: A floating-point number is always 
specified as a fractional number (for example, “12E2” becomes “12.0E2”), indirect 
addressing uses round parentheses (for example, MW[12] becomes MW(12)), and 
the absolute or indirect addressing of data operands is only possible with a data 
block addressed in absolute mode (for example, “DB_name”.DW22 becomes 
%DB10.DW22). 


Some of the standard functions from the JEC Function Blocks library are converted 
during the migration into functions which are available in the TIA Portal: 


S_COMP (comparison of STRING tags) 


S_CONV (data type conversion) or into the notation 
Source data type_TO_Destination data type 


T_COMP (comparison of time data types) 


T_CONV (data type conversion) or into the notation 
Source data type_TO_Destination data type 


T_ADD, T_SUB, and T_ COMBINE 
A syntax error is output if unambiguous conversion is not possible. 


The EN/ENO mechanism with SCL programs is adapted to that of the TIA Portal: 
The OK tag is replaced by the ENO tag, which simultaneously controls the ENO out- 
put. Following the migration, the previous positions of use of OK tags must also be 
adapted to the new EN/ENO mechanism if applicable. 


Migration of GRAPH blocks 


A prerequisite for the migration of GRAPH blocks is that an S7-GRAPH V5.3 SP6 
(or later) option package is installed. 


The GRAPH-specific block settings are significantly reduced in the TIA Portal and 
this can result in changes in the interface. It may be necessary in this case to update 
the block call and to regenerate the instance data block. 
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18.3 Simulation with the TIA Portal 


The TIA Portal contains the S7-PLCSIM simulation software which emulates a pro- 
grammable controller. As a result, you can use the programming device to test the 
user program without additional hardware. 


No connections to “real” programmable controllers must exist when using the sim- 
ulation. Any existing online connections are cleared when starting the simulation. 


The program of only one station can be simulated at a time. 


18.3.1 Differences from a real CPU 


The simulation software cannot emulate a real programmable controller to 100%, 
but can additionally execute a number of useful functions. Some differences from 
a “real” CPU 400 are listed below. 


The user program in a simulation can be executed cyclically or automatically. Cycli- 
cally means that the program is executed completely once and only starts the next 
processing cycle when requested. 


The output statuses of the simulated CPU are not changed when at STOP. 


In the simulation subwindows you specify the tag values with which the program is 
to work. These changes are imported immediately and not only at the cycle control 
point as with a CPU 400. In the case of an input, the modified signal state is also cop- 
ied immediately into the I/O area I:P so that the modified value is not overwritten 
during the next updating of the process image. A modified signal state of an output 
immediately updates the corresponding I/O output Q:P. Forcing is not supported by 
PLCSIM. 


You can reset individual or all SIMATIC timers or assign them different time values 
using a menu command. Processing of error and interrupt organization blocks can 
be triggered manually. 


Modules which are inserted during ongoing operation can be detected and config- 
ured by a CPU 400. PLCSIM does not support this automatic configuration. PLCSIM 
works with the modules which are present in the loaded hardware configuration. 


PLCSIM does not support any FM modules. PLCSIM does not support all system 
blocks. Non-supported system blocks are ignored in the simulation. 


18.3.2 Starting and saving the simulation 


You have created a user program and compiled it without errors and it could there- 
fore be executed on a CPU. You can then test it using the simulation software. 


To start the simulation, select the station or the Program blocks folder in the project 
tree and then select the Online > Simulation > Start command from the main menu. 
Following the start, PLCSIM is presented in a separate window which contains the 
“subwindow” CPU (Fig. 18.3). The simulated user program is supplied with tag val- 
ues via further subwindows - for example for inputs and outputs. 
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Fig. 18.3 Input window of the PLCSIM simulation software 


Using the View > Always On Top command you can ensure that the simulation win- 
dow is not covered by other windows. To set the PG/PC interface, select the access 
mode to the simulated CPU from the drop-down list in the toolbar, for example MPI 
or TCP/IP. 


The simulated CPU responds like a real CPU switched online. You establish a con- 
nection to the simulated CPU and can then use the online and diagnostics tools. 
Following starting, the simulated CPU is displayed in the project tree under 
Online access > PLCSIM V5.x [access mode]. 


When downloading the user program, proceed as described in Chapter 15 “Online 
operation and program test” on page 592. 


Saving and restoring the simulation 


You can save the current state of a simulation and then load this state again later 
for continued processing. 


To save the automation system for the first time, select the File > Save PLC As ... com- 
mand and specify the storage location. You can save an intermediate state of the 
simulation using File > Save PLC. The <name>.plc file saves the operating state, the 
user program, the hardware configuration, and the current signal states of the sim- 
ulated programmable controller. 


You can save the current subwindows using File > Save Layout as. The <name>.lay 
file saves the current simulation windows together with their positions and con- 
tents. You can save the window arrangement in a previously created file using 
File > Save Layout. 


You restore the simulation using File > Open PLC and File > Open Layout. Using File 
> Recent Simulation > ... and File > Recent Layout > ... you can select the files which 
have been saved last from a list. 
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18.3.3 Using the simulation 


Controlling the CPU 


The CPU subwindow emulates the control and display elements of a CPU. LED sym- 
bols indicate the current operating mode (RUN or STOP) and a group error (SF). 
You control the operating mode by activating checkboxes: STOP, RUN, and RUN-P. If 
the RUN checkbox is activated, the user program cannot be modified when in RUN 
mode. With the RUN-P checkbox activated, the simulated CPU responds like a 
CPU 400 in RUN mode. 


You can use the MRES button to trigger a memory reset for the simulated CPU. 


Addressing operands 


You use the bit, byte, word, or doubleword address when addressing operands, for 
example IB12 for the input byte 12. In the case of a byte address, you can individu- 
ally monitor and control the bits of the byte. The peripheral operand area is ad- 
dressed using PI (peripheral inputs) or PQ (peripheral outputs). 


For a data operand you use the complete addressing with data block and data oper- 
and, for example DB10.DBW24. 


The operand ID for a SIMATIC timer function is “T” and “C” for a SIMATIC counter 
function. 


Subwindows for inputs, outputs, bit memories, and data 


You can insert an empty subwindow into the working window of the simulation us- 
ing Insert > Input Variable, ... > Output Variable, ... > Bit Memory or ... > Generic. Each 
subwindow accommodates one operand. You can insert any number of subwindows 
and arrange them as desired in the simulation window (Fig. 18.4). 


You can use these subwindows to monitor and control operands from the following 
operand areas: inputs (I), peripheral inputs (PI), outputs (A), peripheral outputs (PQ), 
bit memories (M), and data (DB). 


You enter the operands in the left box. With peripheral inputs and outputs it is pos- 
sible to specify a byte (PIB, PQB), a word (PIW, PQW), or a doubleword (PID, PQD). 
You address a data operand together with the data block (“complete addressing”). 
Depending on the operand width (bit, byte, word, or doubleword), select the data 
format from the drop-down list with which you wish to display and control the op- 
erand value. 


If you select the Slider format from the drop-down list, a slider is displayed which 
you can adjust using the mouse pointer. INT and DEC are available as display for- 
mats. You set the limits for the adjustable range using Min and Max from the bot- 
tom drop-down list. The adjustable value is displayed using the Value setting from 
this drop-down list. 
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Fig. 18.4 Subwindows for monitoring and control 


Subwindow “Vertical bits” 


You can use Insert > Vertical bits to insert a subwindow into the simulation window, 
which arranges the bits among themselves and which can be labeled with the abso- 
lute address. 


Subwindows for SIMATIC timers and counters 


You insert a subwindow for a SIMATIC timer or counter function using Insert > 
Timer, Insert > Counter, or Insert > Generic. The subwindow for a timer function 
contains the duration divided according to time value (0 to 999) and time frame 
(10 ms, 100 ms, 1s, 10s). You can select binary, hexadecimal, BCD, and S7 format 
(W#16#xxxx) as the formats for a count value. 


If you specify a timer or counter operand in a subwindow for inputs, outputs or bit 
memories, the current timer or counter value is displayed in selectable formats 
(also with slider). 


Using the Execute > Manual Timers command you can stop time processing by the 
simulation and you can set time values in the subwindows. Using the Execute > 
Automatic Timers command, the simulation continues with processing of the timer 
functions. 


You can reset all or individual timer functions. With the Execute > Reset Timers com- 
mand you can select in the dialog window whether you wish to reset all timer func- 
tions or only a specific timer function. You can do the same using the T=0 button 
(reset timers) in the CPU mode toolbar (all timers) or the T=0 button in the bottom 
window of the timer. 
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Further subwindows 


You can use the View > ... command from the main menu to insert subwindows for 
CPU-internal registers (Fig. 18.5). 
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Fig. 18.5 Subwindows for the CPU-internal registers 


The View > Accumulators command shows the ACCUs & Status Word subwindows. 
This shows the assignments of the accumulators, the address registers, and the sta- 
tus word. 


The View > Block Registers command shows the Block Regs subwindow. This shows 
the current assignment of the data block registers, the current and previous logic 
blocks, and the value of the STEP address counter (SAC) an. 


The View > Stacks command shows the Stacks subwindow. This shows the used 
depth of the nesting stack and the assignments of the status bits RLO and OR. In ad- 
dition, the current level of the master control relay (MCR) is shown with the status 
bit RLO and the MCR activity bit. 


18.3.4 Testing the program with the simulation 


The program has been loaded into the simulation and at least the subwindow for 
the CPU is present. You can use this subwindow to trigger the change between STOP 
state and RUN mode. The green RUN LED indicates a successful start and the red 
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STOP LED and the red SF LED (group error) indicate a “serious” error in the user 
program. 


You simulate switching on and off of the power supply using PLC > Power on and 
PLC > Power off. The green DC LED indicates that a supply voltage is present. 


You can immediately stop the continuous cyclic program execution using the Pause 
button in the toolbar, or at the end of the cycle using the Single Scan button (alter- 
natively using the Execute > Scan Mode > Single Scan command). Each click on the 
Next Scan button requests the simulation to execute one single further cycle. Click- 
ing on the Continuous Scan button reestablishes continuous program execution. 


The cycle time monitoring is switched on as standard and set to the maximum value 
6000 ms. You can use Execute > Scan Cycle Monitoring... to deactivate it or to set a 
different value. 


Online functions, watch tables, and program status 


The programming device treats the simulated programmable controller like a real 
one. With the simulation switched on, you can connect the station online and then 
use the online functions such as reading the diagnostic buffer. The simulated CPU 
can be started and stopped using the CPU control panel in the online tools. The 
further possibilities offered by STEP 7 are described in Chapter 15.4 “Hardware 
diagnostics” on page 608. 


You can also use the test functions of STEP 7 on the simulated CPU. Testing with 
watch tables and program status is described in Chapter 15.5 “Testing the user 
program” on page 613. Forcing with a force table is not possible with a simulated 
CPU. 


Error and interrupt organization blocks 


If a program error occurs, e.g. access to an operand which does not exist, PLCSIM 
responds by calling the synchronous error organization block OB 122. If this is not 
present in the program, the simulated CPU goes to STOP. The further procedure is 
as when testing with a real CPU. 


For testing purposes, you can also manually trigger the starting of an error or in- 
terrupt organization block. You can use Execute > Trigger error OB >... to start single 
processing of the selected organization block. You set the triggering conditions 
(with a real CPU), for example the errors which can trigger a diagnostic interrupt, 
in a dialog window (Fig. 18.6). 


18.3.5 Additional functions of PLCSIM 


Recording and playback 


To achieve (simple) simulation of a connected machine or controlled process, 
change the operand values in the subwindows into a sequence meaningful for test- 
ing. You can record this sequence of data modifications and play it back again at dif- 
ferent speeds in order to observe the response of the user program. 
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Fig. 18.6 Examples of trigger conditions with error and interrupt organization blocks 


You can start recording and playback using the Tools > Record/Playback command. 
You are provided with a window with function symbols for controlling the recorder 
functions. 


Initially create a file using the New event file symbol in which you wish to save your 
recorded inputs. Click on the Record symbol to start recording. The subsequent 
changes in values in the subwindows are saved in chronological order. The Pause 
symbol interrupts the recording, the Stop symbol terminates the recording. Save 
the recording using the Save event file symbol. 


To play back, fetch the saved inputs using Open event file. You can initially use the 
Delta symbol to set the speed at which the recording is to be played back. The rela- 
tive intervals between the individual inputs are retained. Start the playback using 
the Play symbol and terminate it using the Stop symbol. 


S7ProSim 


PLCSIM uses S7ProSim as a COM object or ActiveX control which can be used in ap- 
plications which support Microsoft's OLE/COM technology. You can thus expand 
PLCSIM by process simulation, where software development knowledge in Visual 
Basic or Visual C++ is a requirement. 
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18.4 Web server 


CPUs with an Ethernet interface have a web server that provides information from 
the CPU. To read out the information you require a web browser which displays the 
information on the HTML pages. 


18.4.1 Enable web server 


You enable the web server with the hardware configuration using the Enable web 
server on this module checkbox in the CPU properties under the Web server group. 
You can use the dialog window Enable system diagnostics to permit the display of 
diagnostic information in the web server by means of Report System Errors (RSE) in 
order to obtain the complete functionality of the web pages on the module status, 
topology, and messages. 


By activating the Permit access only with HTTPS checkbox you limit access to the se- 
cure hypertext transmission protocol. You additionally require a certificate for this 
which you can download and install via a link on the start page of the web server. 
Furthermore, the time must be set on the CPU. 


Further settings concern the time interval for automatic updating of the web pages, 
the project language used, and the user management. 


User is authorized ... 


{4 Diagnostics to query 


{4 Tags to read User management 

(4 Read tag status Name Access level 
Everybody Minimum 
user2 Restricted 


to ackno 
() Open user-defined pages 
[) Mite in user-defined web pages 


| || 
OK 


Fig. 18.7 User management in the web server 


User management 


If no users are configured, anyone can read all web pages without being logged on. 
Auser “Everybody” can access all web pages enabled for the user “Everybody” with- 
out being logged on and without a password. Access privileges to the web pages can 
be assigned individually to a configured user with password. 
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To create a new user, enter a user name in the next line and click in the access level 
cell. Select the required privileges from the list (Fig. 18.7). 


18.4.2 Reading out web information 


In order to access the CPU's web server, the PC or PG must establish an Ethernet 
connection (TCP/IP) to the CPU. Start the web browser and enter the CPU's IP 
address as URL in the form http:/aaa.bbb.ccc.ddd or - for a secure connection - 
https:/aaa.bbb.ccc.ddd. 


Automatic updating is disabled in the basic setting and the web pages therefore de- 
liver static information. You can switch the automatic updating on and off using the 
function key F5 or the Enable/disable automatic refresh symbol at the top right on 
the displayed page. If web pages are printed, their contents are always up-to-date. 


To enable logging on, two input boxes are provided for the user name and password 
on every page at the top left. 


18.4.3 Standard web pages 


The first page displayed by the web server is the Welcome page. From here, click on 
ENTER to reach the Start page. If you want to skip this intro page in the future, 
activate the Skip Intro option. 


Start page 


The Start page shows the station name, the module name, the CPU type, and the sta- 
tus at the time of scanning: operating state, diagnostics state, and position of the 
mode switch. 


Identification 


The Identification page contains the plant designation and location identifier, the 
serial number, the Order No., and the version information of the hardware, firm- 
ware, and boot loader. 


Diagnostic buffer 


The Diagnostic buffer page shows the contents of this buffer. The maximum size of 
the diagnostic buffer depends on the CPU used; the size used can be configured. Se- 
lect the group to be displayed from the drop-down list. Detailed information is dis- 
played on the selected event (Fig. 18.8) . 


You can select the display language in the window at the top right. If the selected 
language is not configured, the information is displayed in hexadecimal code. 


Module state 
Prerequisites for display on the Module information page are: 


> Enabling of system diagnostics with Report System Errors with the hardware con- 
figuration in the CPU properties under System diagnostics 
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Fig. 18.8 Display of diagnostic buffer in the web browser 


> Cyclic calling of the function block RSE_FB Signal system errors at least every 
100 ms, with an excessively long cycle time in a cyclic interrupt OB with a time 
interval of at least 100 ms 


> Enabling of diagnostics support in the CPU properties in the Diagnostics support 
group by means of the Diagnostics status DB checkbox 


The Module information page shows the CPU's status. From here you can call up the 
status of individual modules. Use the link in the “Heading” to access a higher mod- 
ule level, the links in the table column Name to access lower levels. 


The module information of a component is displayed by various symbols: OK, 
Disabled, Not accessible, Maintenance requirement, Maintenance request, Fault in 
component, and Fault in a lower module level. 


Messages 


The Messages page displays the configured messages in chronological order, 
including the date and time. You cannot acknowledge the messages via the Web 
browser. 


You can search for specific information with filter settings. With sort functions, you 
can sort the messages, for example according to message number or status. 
Detailed information about the selected message is displayed. 


You can select the display language in the window at the top right. If the selected 
language is not configured, the information is displayed in hexadecimal code. 


The selected display classes of the messages are displayed during operation in plain 
text on the web page Messages, the messages of non-selected display classes in 
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hexadecimal code. You can reduce the memory requirements of the configuration 
data present in the load memory by only selecting the display classes which are ac- 
tually required. 


You configure the display classes for Report System Errors in the CPU properties 
under System diagnostics and for block-related (PLC) messages with the message 
editor. 


Communication 


The Communication page contains the Parameter, Statistics, Resources, and Open 
communication tabs. 


Information on the PROFINET interface can be found in the Parameters and 
Statistics tabs. The MAC address and the IP address are displayed, for example, as 
are statistical analyses of sent and received data packages. 


The Resources tab shows the number of connections which are available, reserved, 
and occupied. The status of the communication connections are shown in the Open 
communication tab. 


Topology 


The Topology page shows the topological structure and the status of a PROFINET IO 
system. The Graphic view tab shows the reference topology and the actual topology 
in a graphic representation, the Table view tab shows only the actual topology. 


The Status overview tab shows the status of all PROFINET IO devices present in the 
project without the connection relationships and thus permits fast locating of the 
error location. 


Tag status 


On the Tag status page you can monitor the status of up to 50 tags. When you spec- 
ify the address of the tag and the display format, you receive the value of the tag. 


You can select the display language in the window at the top right. When specifying 
addresses, please note that the mnemonics for English (e.g. “I” for input) differs 
from those of other languages (“E” in German, for example). Syntax errors are in- 
dicated in red. 


Variable tables (watch tables) 


On the Variable tables page you have the opportunity to make your defined watch 
tables accessible to users via the web browser. You have previously selected an ex- 
isting table by means from the drop-down list in the CPU properties under the Web 
server > Watch tables group, and specified by means of the drop-down list of the sec- 
ond column whether a read or write access is to be permissible. 


The web server allows you to monitor up to 50 watch tables with up to 200 tags each. 
The memory space available in the CPU might not be sufficient to make use of all 
the possibilities. If watch tables are displayed incompletely, reduce the memory re- 
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quired by the messages and symbol comments. If possible, use only one language 
and keep the number of tags per table low. 


To display a watch table, select one of the available tables (previously configured in 
the web server) from the drop-down list. 


Customer pages 


On the Customer pages page, the web server shows the link to user-programmed 
web pages. When configuring the web server, you can specify the web pages in the 
CPU properties which you wish to load together with the other settings of the web 
server into the CPU. 


WWW Initialize web server and synchronize web pages (SFC 99) 


The system function WWW initializes user-defined pages in the web server of the 
CPU and synchronizes access between the pages and the user data. The system 
function is called cyclically in the user program. You can find the system function 
in the program elements catalog in the section Communication under WEB server 
(Fig. 18.9). 


System block for synchronization of Web pages and user programs 


SFC 99 
Synchronize Web pages 
www The "Start data block" is created at the CTRL_DB parameter and 
contains user-defined Web pages and references to further 
— CTRL_DB RET_VAL — data blocks with user-defined Web pages. 


Fig. 18.9 Graphic representation of system function WWW 


18.5 Storage of local tags 


Block parameters are stored differently in the case of functions and function blocks. 
You as a user not need be bothered by this; you program the parameters for both 
types of block in the same manner. However, this difference is very important for 
direct access to the block parameters. 


When programming a function block for which the Multiple instance capability at- 
tribute is activated, you need not be bothered in the case of symbolic addressing of 
the local data tags whether this function block is subsequently called as a single in- 
stance or local instance. However, direct access is then only possible indirectly via 
the address register AR2. 


18.5.1 Storage in global data blocks 


The program editor stores the individual tags in the data block in the sequence of 
their declaration. The following rules essentially apply: 
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The first bit tag of an uninterrupted declaration sequence is in bit 0 of the next 
byte, and this is followed by the next bit tags. 


Byte tags are stored in the next byte. 


Word and doubleword tags always commence at a word limit, i.e. at a byte with 
even address. 


DT and STRING tags commence at a word limit. 


ARRAY tags commence at a word limit and are “filled” up to the next word limit. 
This also applies to bit and byte fields. Field components with elementary data 
types are stored as described above. Field components with higher data types 
commence at word limits. Each dimension of a field is oriented like an indepen- 
dent field. 


> STRUCT tags commence at a word limit and are “filled” up to the next word limit. 
This also applies to pure bit and byte structures. Structure components with 
elementary data types are stored as described above. Structure components with 
higher data types commence at word limits. 


By combining bit tags and by arranging byte tags in pairs you can accommodate 
your data in a data block with optimum use of memory space. 


Fig. 18.10 shows an example of non-optimized data storage. Note that the editor 
must always “fill” ARRAY and STRUCT tags up to the next word; i.e. no bit or byte 
tags can be placed in a resulting byte gap. However, you can arrange the tags opti- 
mally within the structure. You can achieve an optimum arrangement in the exam- 
ple if you declare the BYTE tag positioned following the REAL tag in front of the RE- 
AL tag, set the BYTE component in the STRUCT tag in front of the INT component, 
and declare the last declared BYTE tag in front of the DATE tag. The changed se- 
quence in declaration then reduces the memory space requirements by five filler 
bytes. 


18.5.2 Storage in instance data blocks 


The program editor stores the tags in an instance data block in the following order: 


> Input parameters 
> Output parameters 
> In/out parameters 


> Local tags including local instances 
Each tag is saved in the order of its declaration. Each declaration area commences 
at a word limit, i.e. at a byte with even address. The individual tags are arranged 


within the declaration areas as described in the previous chapter (as in a global data 
block). Fig. 18.10 shows an example of the occupation of an instance data block. 


732 


18.5 Storage of local tags 


Data storage in a data block 


The tags in a data block are stored in the order of their declaration. All tags with a width of 16 bits or more 
start at a byte with even address. In certain cases, an address must therefore be bypassed in the 
assignment, and a"filler byte" is inserted. By using an adept sequence for the declaration, it is possible to 
minimize the number of filler bytes and thus the memory requirements. 
All declaration sections for an instance data block commence at a byte with even address, and also the 
data ofa local instance in this case. 
The same assignment pattern of a global data block also applies to the temporary local data. With an 
organization block, the first 20 bytes (bytes 0 to 19) are occupied by the start information. 
The assignment with user tags then only commences with byte number 20. 
The symbol <J_ indicates an even byte address 
Storage in a global data block Storage in an instance data block 
Bit 7 65 43 2 10 Bit 7 65 43 2 1 0 
BOOL 21550 BOOL 2 1 0 <q Input 
(Filler byte) (Filler byte) parameters 
REAL <J REAL 
BYTE BYTE <] Output 
filer) BYTE parameters 
ARRAY OF BOOL 2) | 0) Bea} BYTE 
(Filler byte) (Filler byte) 
STRUCT | BOOL 21110 Real BYTE <J in/out 
(Filler byte) BOOL PEN parameters 
INT DATE 
BYTE STRING <] Static local 
(Filler byte) Hore 
STRING <4 
(Filler byte) 
ARRAY OF BOOL 2 \ il | © 
(Filler byte) (Filler byte) 
DATE <4 INT 
CHAR CHAR 


Fig. 18.10 Data storage in data blocks 


18.5.3 Storage in the temporary local data 


Storage of the tags in the temporary local data (L stack) corresponds to storage ina 
global data block. The assignment always commences with the (relative) byte 0. 
Note with organization blocks that the first 20 bytes are occupied by the start infor- 
mation. The first 20 bytes must be declared even if you do not use the start infor- 
mation — even if you only declare an array with 20 bytes. 
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The editor itself also uses local data, for example to transfer parameters during a 
block call. The temporary local data declared symbolically as well as that used by 
the editor itself is stored by the editor in the sequence of declaration or use. The 
temporary local data addressed absolutely is not considered here so that overlap- 
ping could result if you do not know what local data is created by the editor. 


If you wish to access local data in absolute mode or if it is essential to do so, you can 
declare an array at the first position of the temporary local data declaration which 
reserves the required number of bytes (words, doublewords). You can then access 
this array area in absolute mode. With organization blocks, you define the array fol- 
lowing the 20 bytes for the start information. 


18.5.4 Data storage of the block parameters of a function (FC) 


The program editor stores a block parameter of a function as a cross-area pointer in 
the block code following the actual call statement and therefore every block param- 
eter requires a doubleword in the memory. The pointer points to the actual param- 
eter itself depending on the type of data and declaration, to a copy of the actual pa- 
rameter in the temporary local data of the calling block (the program editor creates 
this), or to a pointer in the temporary local data of the calling block which in turn 
points to the actual parameter (Table 18.4). Exception: With the parameter types 
TIMER, COUNTER, and BLOCK_xx, the pointer is a 16-bit number located in the left 
word of the block parameter. 


Table 18.4 Parameter storage for functions 


Data type INPUT IN_OUT OUTPUT 
The parameter is an area pointer to a 

Elementary Value Value Value 

Complex DB pointer DB pointer DB pointer 

TIMER, COUNTER, BLOCK Number = 7 

POINTER DB pointer DB pointer DB pointer 

ANY ANY pointer ANY pointer ANY pointer 


With elementary data types, the block parameter points directly to the actual oper- 
and (Fig. 18.11). With the area pointer as block parameter, however, it is not possi- 
ble to access any constants or operands located in data blocks. Therefore, when 
compiling the block, the program editor copies the value of a constant or an actual 
operand present in a data block (and completely addressed) into the temporary 
local data of the calling block and points the area pointer to this. This operand area 
is named V (temporary local data of preceding block, V area). 


Copying into the V area is carried out prior to the actual FC call in the case of input 
and in/out parameters, but following the call in the case of in/out and output param- 
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Parameter transfer for functions (FC) 


Pointer to the actual operand or its value 


A block parameter of a function (FC) is a 32-bit area pointer. If the block parameter has an elementary 
data type and if the actual operand is a simple operand, then the pointer points directly to the actual 
operand. A constant as an actual operand or a completely addressed operand cannot be accessed with 
a32-bit pointer. In such cases the program editor copies the value of the constant or data operand into 
the temporary local data of the preceding block and positions the pointer of the block parameter to this 
value. 


Function FC 


Block . . 
parameters Pointer directly 


to the actual 


operand Actual operand is a 
Area —— [Eon one's7 simple operand. 
pointer 


Pointer to the Local data V 


copy in the Copy to penta ta is 
local data local data a constan 
Area ————> Elementary <t——_1> or a completely 
addressed 


pointer data operand 


Pointer to a further pointer 


If the block parameter has a complex data type or the parameter type POINTER, the program editor 
creates a 48-bit pointer to the actual parameter in the temporary local data of the preceding block. 
The block parameter of the FC then points to this DB pointer. 

If the block parameter has the parameter type ANY, the program editor creates an 80-bit pointer to the 
actual parameter in the temporary local data of the preceding block. 

Exception: The actual parameter already has the data type ANY and is in the temporary local data of the 
preceding block. A further pointer is not created in this case. 


Function FC Local data V 

Block Pointer to a . 

parameters pointer in the Pointer to the 
local data actual operand 

Area —————» DB ———> ene Actual o 

i : operand is a 
pointer pointer complex tag 
(48 bit) pound 
Pointer to a : 
NY pointer in the Pointer to the 

local data actual operand Actual 

Area ————— ANY ——> operand is any 

5 a tag except 
pote igtehh iiss: zaDY, with data type ANY 
(80 bit) in the temporary 
local data 

Pointer to the 

ANY ANY pointer in 
the local data 

Area Tag with data type ANY in 

pointer the temporary local data 


(of the calling block) 


(80 bit) 


Fig. 18.11 Parameter transfer for functions (FC) 
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eters and thus also with the function value. The principle therefore also applies that 
you can only scan input parameters and only write output parameters. For exam- 
ple, if you transfer a value to an input parameter with a completely addressed data 
operand, the value is stored in the temporary local data of the preceding block and 
forgotten, since copying into the “actual” tag in the data block no longer takes 
place. 


The same applies to loading a corresponding output parameter: Since copying 
from the “actual” tag from the data block into the V area does not take place, you 
load an (indefinite) value from the V area in this case. 


As aresult of the copying process, you must write an output parameter with a value 
and thus also a function value defined with an elementary data type in the block if 
a completely addressed data operand is envisaged or could be used as the actual pa- 
rameter. If you do not assign a value to the output parameter, e.g. because you leave 
the block beforehand or jump beyond the program position, the local data is not 
supplied either. It then has the value which it had “by chance” prior to the block call. 
The output parameter is then written with this “undefined” value. Note in this con- 
text that certain operations, for example retentive setting, do not write a value to 
the operand if they are processed with the result of logic operation “O”. 


With complex data types (DT, STRING, ARRAY, STRUCT, and UDT), the actual param- 
eters are either in a data block or in the V area. Since an area pointer cannot access 
an actual operand in a data block, the program editor creates a DB pointer in the 
V area when compiling which then points to the actual operand in the data block 
(DB No. <> 0) or to the V area (DB No. = 0). The DB pointers for all declaration types 
in the V area are created before the “actual” FC call. 


With the parameter types TIMER, COUNTER, and BLOCK_xx, anumber is present in- 
stead of the area pointer in the block parameter (16 bits left-justified in the 32-bit 
parameter). 


The parameter type POINTER is handled just like a complex data type. 


With the parameter type ANY, the program editor creates a 10-byte long ANY point- 
er in the V area which can then point to any tag. The principle is the same as with 
the complex data types. 


An exception is made by the program editor if you apply an actual parameter to a 
block parameter of type ANY where the actual parameter is in the temporary local 
data and is of type ANY. In this case the program editor does not create any further 
ANY pointers but applies the area pointer (the block parameter) directly to the 
actual parameter. In this case, the ANY pointer can be changed during runtime, see 
Chapters 4.6.3 ““Variable” ANY pointer with STL’ on page 138 and 4.6.4 ““Variable” 
ANY pointer with SCL” on page 138. 


18.5.5 Data storage of the block parameters of a function block (FB) 


The program editor stores the block parameters of a function block in the instance 
data of the call. With a function block call, the program editor generates statement 
sequences which copy the values of the actual parameters prior to the actual call in- 
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to the instance data and back again from the instance data to the actual parameters 
following the call. You do not see these statement sequences when viewing the com- 
piled block, you only notice this indirectly because memory space is occupied. 


The block parameters are present in the instance data either as a value, a 16-bit 
number, or a pointer to the actual parameter (Table 18.5). When storing as a value, 
the memory space required depends on the data type of the block parameter; the 
number occupies 2 bytes, a DB pointer occupies 6 bytes, and an ANY pointer occu- 
pies 10 bytes. 


Table 18.5 Parameter storage for function blocks 


Data type INPUT IN_OUT OUTPUT 
Elementary Value Value Value 
Complex Value DB pointer Value 
TIMER, COUNTER, BLOCK_xx Number - - 
POINTER DB pointer DB pointer - 

ANY ANY pointer ANY pointer - 


The relationships between block parameters, instance data assignment, and actual 
parameters are shown in Fig. 18.12. When copying actual parameters with complex 
data type into the instance data (input parameters) or back to the actual parameter 
(output parameters), the program editor uses the system function BLKMOV whose 
parameters are formed in the temporary local data area of the calling block. 


Copying of block parameters saved as values in the instance data is carried out pri- 
or to the “actual” FB call by means of statement sequences for input and in/out pa- 
rameters, but following the call in the case of in/out and output parameters. The 
principle therefore also applies that you can only scan input parameters and only 
write output parameters. For example, if you transfer a (new) value to an input pa- 
rameter, the current value of the actual parameter is lost. If you load an output pa- 
rameter, you load the (old) value in the instance data block and not that of the ac- 
tual parameter. 


Because the block parameters are saved in the instance data, they need not be sup- 
plied each time the function block is called. If no values are supplied, the program 
uses the “old” value of the input or in/out parameter, or you fetch the value of the 
output parameter at a different position later in the program. You can address the 
tags in the instance data outside the function block just like the tags in a global data 
block (with an instance data block) or like a STRUCT tag (with a local instance). 


If you apply a temporary local tag with data type ANY to an ANY parameter, the pro- 
gram editor copies the content of this tag into the ANY pointer (into the block pa- 
rameter) in the instance data. 
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Parameter transfer with function blocks 


Value in the instance data 

A block parameter of a function block is located in the instance data of the call. If the block parameter has 
an elementary data type, the value of the actual parameter is copied into the instance data or from the 
instance data to the actual parameter. 

The same applies to an input or output parameter with compound data type. 

If the block parameter has a data type TIMER, COUNTER or BLOCK_xx, the number of the timer or counter 
function or of the block is present in the instance data. 


Instance data 


Block 
parameters 


INPUT 
OUTPUT 
IN_OUT 

Copy Actual parameter is a simple operand 
Value SSAA a constant, or a completely addressed 
data operand 


<j-—_—_ > Actual parameter is a complex tag 


Pointer in the instance data 
If an in/out parameter has a compound data type, a 48-bit pointer to the actual parameter is created in the 
instance data. 


If a block parameter has the data type ANY, an ANY pointer to the actual parameter is created in the 
instance data. Exception: if the actual parameter also has the data type ANY and is located in the 
temporary local data, itis copied into the instance data. 


Instance data 


Block 
parameters 


Pointer to the actual operand 


IN_OUT 
DB 
pointer 
(48 bits) 


Actual parameter is a complex tag 


INPUT 2 
IN_OUT Pointer to the actual operand 


ANY ———> 
pointer Any 
(80 bits) 


Actual parameter is any tag except data 
type ANY in the temporary local data 


INPUT ’ 
IN_OUT Copy of the ANY pointer 


Actual parameter is a tag with 


ANY 
data type ANY in the temporary local data 


pointer pointer 
(80 bits) (80 bits) 


Fig. 18.12 Parameter transfer with function blocks (FB) 
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18.5.6 Data storage of a local instance in a multi-instance 


Function blocks require a data block - the instance data block - in order to save the 
block parameters and the static local data. This can be a separate data block or — if 
the call of the function block is within a function block - the instance data block of 
the calling function block. You define the data block in which the instance data is 
saved when calling the function block: 


> Ifyou select Single instance, a separate data block is generated for the call of the 


function block. 


> If you select Multi instance, the data of the called function block is inserted as a 
“local instance” in the instance data block of the calling function block. 


The data of a local instance is a subset of the static local data of the calling function 
block (Fig. 18.13). The local instance has a name which you define during program- 


Data storage of a local instance in a multi-instance 


Calling, "higher" 
function block 
(multi-instance) 


Block parameters 


Static local data 


Interface 


Declaration of the 
local instance 


Program execution in 
the calling function 
block 


Call of local instance 


Vv 


Wy 


a 


<q------- 


——SSSS of the calling function 


ooo 


Function block 


called as local instance 


Interface 


Block parameters 


Static local data 


Program execution 
in the called 
function block 


> Block parameters 


> Static local data 


Instance data block 


block (multi-instance) 


Block parameters 


Static local data 


Data of local 
instance 


A function block called as a local 
instance is declared in the static local 
data of the calling "higher-level" 
function block. 


The instance data of the called 
function block (block parameters and 
static local data) is then stored in the 
instance data block of the calling 
function block. 


Fig. 18.13 Data storage of a local instance in a multi-instance 
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ming of the statement. In a function block you can program several local instances 
of the same function block by defining different instance names for each of them. 


The individual components of a local instance are shown in the instance data 
block in Expanded mode. You can address the components of a local instance from 
the calling function block as a static local tag using #Instance_name.Compo- 
nent_name or from any block as a global data tag using “Data_block_name’”. 
Instance_name.Component_name. 


Function blocks with local instances can again be a local instance. In this manner 
you can “nest” up to eight instances. 


You handle the call of a system function block (SFB) just like the call of a function 
block. Whereas the program of the SFB is present in the CPU's operating system, the 
instance data of the SFB is stored in the user memory. 
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With FBD 338 
With LAD 305 
With SCL 414 
With STL 375 

SIMATIC counter 
Description 495 
With FBD 326, 331 
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With LAD 294, 298 
With SCL 407 
With STL 363 
SIMATIC timers 
Description 477 
With FBD 326, 329 
With LAD 293, 297 
With SCL 406 
With STL 361 
Slot address 70 
SNC_RTCB (SFC 48) 190 
SRT_DINT (SFC 32) 204 
START (SFB 19) 689 
Start information 
Datatype 141 
Read out with RD_SINFO 
228 
Startup program 171 
STATUS (SFB 22) 690 
Status bits 
Description 561 
Evaluate 566 
Status bit /FC 561 
Status bitOR 562 
Status bitOS 562 
Status bitOV 562 
Status bit RLO 561 
Status bits CCO and CC1 
562 
Status STA 561 
Status interrupt (OB 55) 
208 
Status word 563 
STEP 7 
Portal view 31 
Project view 33 
STOP (SFB 20) 689 
STP (SFC 46) 186 
STRING (datatype) 128 
STRING functions 556 
STRUCT (datatype) 131 
Symbol table 
See PLC tag table 
SYNC_PI (SFC 126) 211 
SYNC_PO (SFC 127) 211 
SYNC/FREEZE 661 
Synchronous cycle inter- 
rupts 
(OB 61 to OB 64) 209 
Synchronous error (OB 
121 and OB122) 213 
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T branch 
With FBD 322 
With LAD 288 
T_ADD (FC 1) 526 
T_COMBINE (FC 3) 526 
T_CONV 537 
T_DIFF (FC 34) 526 
T_SUB (FC 35) 526 
TADDR_PAR (UDT 66) 700 
Tag tables 
See watch tables 
Tags 
Controlling 625 
Declaring data tags 273 
Forcing 628 
Introduction 89 
Monitoring with PLC tag 
table 621 
Monitoring with watch 
table 624 
PLC tag table 254 
TCON (FB 65) 695 
TCON_PAR (UDT 65) 695 
TDISCON (FB 66) 695 
TEST_DB (SFC 24) 587 
Time 187 
TIME (data type) 127 
Time error (OB 80) 219 
Time of day 
Setting online 190 
TIME _TCK (SFC 64) 191 
Time-delay interrupts 
(OB 20 to OB 23) 202 
Time-of-day interrupts 
(OB 10 toOB 17) 199 
TIMER (parameter type) 
133 
Timer response 
Extended pulse 484 
OFF delay 489 
ON delay 486 
Pulse 482 
Retentive ON delay 487 
TOF OFF delay 494 
TON ON delay 493 
TP pulse generation 492 
Transfer functions 
Description 508 
With FBD 334 
With LAD 302 
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With STL 367 
TRCV (FB 64) 696 
TSEND (FB 63) 696 
TURCV (FB 68) 699 
TUSEND (FB 67) 699 
Two's complement 543 
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BLKMOV (SFC 81) 514 
NSCALE (FC 106) 542 
PDAT_PI (SFC 26) 181 
PDAT_PO (SFC 27) 181 
pdate interrupt (OB 56) 
208 
RCV (SFB 9) 686 
SEND (SFB 8) 686 
serdata 91 
ser program 
Cycle monitoring time 
183 
Cycle processing time 
611 
Error handling 213 
Loading 596 
Process image 177 
Programming 
With FBD 315 
With LAD 283 
With SCL 397 
With STL 348 
Protect 187 
Response time 183 
Testing with program 
status 614 
Testing with watch ta- 
bles 622 
USTATUS (SFB 23) 690 
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V24_SET_441 (FB 6) 706 

V24_STAT_441 (FB 5) 705 

VOID (parameter type) 
134 
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WAIT (SFC 47) 187 
Warm restart 147 
Watch tables 622 
WHILE (SCL) 423 
WORD (data type) 122 


745 


Index 


Word logic operations 
Description 549 
With FBD 338 
With LAD 306 
With SCL 415 
With STL 377 

WR_SYS_T (SFC 0) 188 
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WR_USMSG (SFC 52) 249 
WRREC (SFB 53) 176 
WWW (SFC 99) 731 
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X_ABORT (SFC 69) 682 
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X_RCV (SFC 66) 681 
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